CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2022-09-19

Last modified

2026-07-09

Weaknesses

CWE-281

Affected products

• Processmaker (Processmaker)

References

• http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html
• https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing