What’s Vulnerable › Vulnerabilities

CVE-2022-32277

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-06 · updated 2026-06-17
• Weakness: CWE-639

Description

Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details. NOTE: this is disputed by both the vendor and the original discoverer because it is a site-specific finding, not a finding about the Squiz Matrix CMS product.

Affected products

• Squiz Matrix: 6.20

References

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/

Get alerted when CVE-2022-32277 or the next vulnerability affects your stack