TI-2022-06457 Aliases CVE-2022-22110 GHSA-96v6-hrwg-p378

DayByDay CRM - Weak Password Requirements in Update User

LOW 35CWE-521Published 2022-01-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-521.

Summary

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.

Why it matters now

EPSS 0.01159 67th percentileScored 2026-11-07

Fix Fixed bottelet/flarepoint (Packagist): 2.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bottelet	DaybydayCRM	up to 2.2.0; 1.1 and later	—	No fix listed	CNA
Bottelet	flarepoint	up to 2.2.0; 1.1 and later	—	No fix listed	CNA
—	bottelet/flarepoint (Packagist)	1.1 to before 2.2.1	2.2.1	Patch available	GHSA-96v6-hrwg-p378

DaybydayCRM VendorBottelet Affected up to 2.2.0; 1.1 and later Fixed in — No fix listed CNA
flarepoint VendorBottelet Affected up to 2.2.0; 1.1 and later Fixed in — No fix listed CNA
bottelet/flarepoint (Packagist) Vendor— Affected 1.1 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-96v6-hrwg-p378

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:daybydaycrm:daybyday_crm::::::::	1.1.0 – 2.2.0	Vulnerable	Bottelet

cpe:2.3:a:daybydaycrm:daybyday_crm:*:*:*:*:*:*:*:* Versions 1.1.0 – 2.2.0 Vulnerable ·Bottelet

Remediation

Fix · GHSA-96v6-hrwg-p378 bottelet/flarepoint (Packagist) Fixed in 2.2.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-01-05
Bottelet DaybydayCRM, flarepoint unspecified
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2022-06455 DayByDay CRM - Missing Authorization when Viewing AbsencesPriority LOW 21
- TI-2022-06454 DayByDay CRM - Missing Authorization when Viewing AppointmentsPriority LOW 21
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-22110
2026-10-03 Alias added: GHSA-96v6-hrwg-p378

References

Patch 1

https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b

Advisory 2

Other 1

https://github.com/Bottelet/DaybydayCRM

TI-2022-06458 DayByDay CRM - Missing Authorization when Changing Password CVSS 3.1HIGH 8.8
TI-2022-06456 DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title CVSS 3.1MEDIUM 5.4
TI-2022-06455 DayByDay CRM - Missing Authorization when Viewing Absences CVSS 3.1MEDIUM 4.3
TI-2022-06454 DayByDay CRM - Missing Authorization when Viewing Appointments CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences