CVE-2022-38577

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-19 · updated 2026-07-09
Weakness: CWE-281

Description

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.

Affected products

ProcessMaker: before 3.5.4 — fixed in 3.5.4

How to fix

Upgrade to a fixed version: ProcessMaker 3.5.4. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html
https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing
http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html
https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing

Get alerted when CVE-2022-38577 or the next vulnerability affects your stack