Search criteria
102 vulnerabilities found for mautic by acquia
FKIE_CVE-2024-47055
Vulnerability from fkie_nvd - Published: 2025-05-28 18:15 - Updated: 2025-10-03 14:11
Severity ?
Summary
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782 | Mitigation, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28D0344B-E313-4B70-BE1A-203412516DBB",
"versionEndExcluding": "5.2.6",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E3CB2C3-C981-460E-BA2E-5B00EE3A7193",
"versionEndExcluding": "6.0.2",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\n\nInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction\u00a0of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\n\nMitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction\u00a0within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions."
},
{
"lang": "es",
"value": "Resumen: Este aviso aborda una vulnerabilidad de seguridad en Mautic relacionada con la funci\u00f3n de clonaci\u00f3n de segmentos. Esta vulnerabilidad permite a cualquier usuario autenticado clonar segmentos sin las comprobaciones de autorizaci\u00f3n adecuadas. Referencia directa a objeto insegura (IDOR) / Falta de autorizaci\u00f3n: Existe una vulnerabilidad de falta de autorizaci\u00f3n en la acci\u00f3n cloneAction de la administraci\u00f3n de segmentos. Esto permite a un usuario autenticado eludir las restricciones de permisos previstas y clonar segmentos incluso si no cuenta con los permisos necesarios para crear nuevos. Mitigaci\u00f3n: Actualice Mautic a una versi\u00f3n que implemente las comprobaciones de autorizaci\u00f3n adecuadas para la acci\u00f3n cloneAction dentro de ListController.php. Aseg\u00farese de que los usuarios que intenten clonar segmentos posean los permisos de creaci\u00f3n adecuados."
}
],
"id": "CVE-2024-47055",
"lastModified": "2025-10-03T14:11:44.813",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security@mautic.org",
"type": "Secondary"
}
]
},
"published": "2025-05-28T18:15:24.930",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security@mautic.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2024-47053
Vulnerability from fkie_nvd - Published: 2025-02-26 13:15 - Updated: 2025-10-16 17:12
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.
* Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04E01805-B13D-459C-A4AD-9846251C61AF",
"versionEndExcluding": "5.2.3",
"versionStartIncluding": "1.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "This advisory addresses an authorization vulnerability in Mautic\u0027s HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.\n\n * Improper Authorization:\u00a0An authorization flaw exists in Mautic\u0027s API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the \"Reporting Permissions \u003e View Own\" and \"Reporting Permissions \u003e View Others\" permissions, which should restrict access to non-System Reports."
},
{
"lang": "es",
"value": "Este aviso aborda una vulnerabilidad de autorizaci\u00f3n en la implementaci\u00f3n de autenticaci\u00f3n b\u00e1sica HTTP de Mautic. Esta falla podr\u00eda permitir el acceso no autorizado a datos confidenciales de informes. * Autorizaci\u00f3n incorrecta: existe una falla de autorizaci\u00f3n en la implementaci\u00f3n de autorizaci\u00f3n de API de Mautic. Cualquier usuario autenticado, independientemente de los roles o permisos asignados, puede acceder a todos los informes y sus datos asociados a trav\u00e9s de la API. Esto omite los controles de acceso previstos regidos por los permisos \"Permisos de informes \u0026gt; Ver propios\" y \"Permisos de informes \u0026gt; Ver otros\", que deber\u00edan restringir el acceso a los informes que no sean del sistema."
}
],
"id": "CVE-2024-47053",
"lastModified": "2025-10-16T17:12:07.397",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-26T13:15:40.090",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Not Applicable"
],
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"source": "security@mautic.org",
"tags": [
"Product"
],
"url": "https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings"
},
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8xv7-g2q3-fqgc"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
}
],
"source": "security@mautic.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2024-47051
Vulnerability from fkie_nvd - Published: 2025-02-26 13:15 - Updated: 2025-10-16 17:11
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.
* Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.
* Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7CB561B0-7B21-4E13-8242-713E16CC488F",
"versionEndExcluding": "5.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\n\n * Remote Code Execution (RCE) via Asset Upload:\u00a0A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\n\n\n * Path Traversal File Deletion:\u00a0A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system."
},
{
"lang": "es",
"value": "Este aviso aborda dos vulnerabilidades de seguridad cr\u00edticas presentes en las versiones de Mautic anteriores a la 5.2.3. Los usuarios autenticados podr\u00edan aprovechar estas vulnerabilidades. * Ejecuci\u00f3n remota de c\u00f3digo (RCE) mediante la carga de activos: se ha identificado una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en la funcionalidad de carga de activos. La aplicaci\u00f3n insuficiente de las extensiones de archivo permitidas permite a un atacante eludir las restricciones y cargar archivos ejecutables, como scripts PHP. * Eliminaci\u00f3n de archivos mediante el Path Traversal: existe una vulnerabilidad de Path Traversal en el proceso de validaci\u00f3n de carga. Debido a la gesti\u00f3n inadecuada de los componentes de la ruta, un usuario autenticado puede manipular el proceso de eliminaci\u00f3n de archivos para eliminar archivos arbitrarios en el sistema host."
}
],
"id": "CVE-2024-47051",
"lastModified": "2025-10-16T17:11:30.637",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 5.3,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-26T13:15:39.957",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2"
},
{
"source": "security@mautic.org",
"tags": [
"Not Applicable"
],
"url": "https://owasp.org/www-community/attacks/Code_Injection"
},
{
"source": "security@mautic.org",
"tags": [
"Not Applicable"
],
"url": "https://owasp.org/www-community/attacks/Path_Traversal"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-23"
},
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "security@mautic.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-25773
Vulnerability from fkie_nvd - Published: 2025-02-26 13:15 - Updated: 2025-10-16 17:08
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Summary
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.
* Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7CB561B0-7B21-4E13-8242-713E16CC488F",
"versionEndExcluding": "5.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\n\n * Improper Limitation of a Pathname to a Restricted Directory:\u00a0A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory."
},
{
"lang": "es",
"value": "Este aviso aborda una vulnerabilidad de ubicaci\u00f3n de archivos que podr\u00eda permitir que se carguen activos en directorios no deseados en el servidor. * Limitaci\u00f3n incorrecta de una ruta a un directorio restringido: existe una vulnerabilidad en la funcionalidad de carga de activos que permite a los usuarios cargar archivos en directorios fuera del directorio temporal previsto."
}
],
"id": "CVE-2022-25773",
"lastModified": "2025-10-16T17:08:58.823",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-02-26T13:15:32.550",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security@mautic.org",
"type": "Secondary"
}
]
}
FKIE_CVE-2024-47059
Vulnerability from fkie_nvd - Published: 2024-09-18 22:15 - Updated: 2025-02-27 19:43
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "218C24B5-AAED-49DE-BD4D-DA7B37D55744",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration."
},
{
"lang": "es",
"value": "Al iniciar sesi\u00f3n con el nombre de usuario correcto y una contrase\u00f1a d\u00e9bil incorrecta, el usuario recibe una notificaci\u00f3n que indica que su contrase\u00f1a es demasiado d\u00e9bil. Sin embargo, cuando se proporciona un nombre de usuario incorrecto junto con una contrase\u00f1a d\u00e9bil, la aplicaci\u00f3n responde con una notificaci\u00f3n de \"Credenciales no v\u00e1lidas\". Esta diferencia se puede utilizar para realizar la enumeraci\u00f3n de nombres de usuario."
}
],
"id": "CVE-2024-47059",
"lastModified": "2025-02-27T19:43:42.530",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T22:15:04.650",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-25770
Vulnerability from fkie_nvd - Published: 2024-09-18 22:15 - Updated: 2025-02-27 19:42
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "496E995E-E33A-4481-83A6-38172DA11763",
"versionEndExcluding": "4.4.13",
"versionStartIncluding": "1.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
"versionEndExcluding": "5.1.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "99718D48-5C19-41C5-84E1-52E95F012830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "9C1C106B-1B3D-427D-8147-5527E610F569",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "4E35B0F0-9BF1-45FA-8954-B8BFB7389C4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "213A9276-B9D1-4B4D-BBE9-FC42B6D63DE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F366E4D8-1515-4E5F-8551-4C8D9E00D0D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "B4234B41-F219-45B7-83A1-8F0F652F2A8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "DA028F70-6020-47D6-BEC0-6FC0C7E18420",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn\u0027t shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable."
},
{
"lang": "es",
"value": "Mautic permite actualizar la aplicaci\u00f3n mediante un script de actualizaci\u00f3n. La l\u00f3gica de actualizaci\u00f3n no est\u00e1 protegida correctamente, lo que puede generar una situaci\u00f3n vulnerable. Esta vulnerabilidad se ve mitigada por el hecho de que Mautic debe instalarse de una determinada manera para que sea vulnerable."
}
],
"id": "CVE-2022-25770",
"lastModified": "2025-02-27T19:42:12.837",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.4,
"impactScore": 5.8,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T22:15:03.827",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-27917
Vulnerability from fkie_nvd - Published: 2024-09-18 22:15 - Updated: 2024-09-27 15:13
Severity ?
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2 | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F3CFAD0-A8EE-42B3-B30C-3D428E0DB029",
"versionEndExcluding": "4.4.13",
"versionStartExcluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
"versionEndExcluding": "5.1.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "99718D48-5C19-41C5-84E1-52E95F012830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "4E35B0F0-9BF1-45FA-8954-B8BFB7389C4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "213A9276-B9D1-4B4D-BBE9-FC42B6D63DE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F366E4D8-1515-4E5F-8551-4C8D9E00D0D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "B4234B41-F219-45B7-83A1-8F0F652F2A8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "DA028F70-6020-47D6-BEC0-6FC0C7E18420",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report."
},
{
"lang": "es",
"value": "Antes de este parche, exist\u00eda una vulnerabilidad XSS almacenado en el seguimiento de contactos y en el informe de visitas a la p\u00e1gina."
}
],
"id": "CVE-2021-27917",
"lastModified": "2024-09-27T15:13:58.927",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T22:15:03.577",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2024-47050
Vulnerability from fkie_nvd - Published: 2024-09-18 21:15 - Updated: 2024-09-27 15:29
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7 | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE9F17BE-23A1-4088-9B04-27DE04CC756E",
"versionEndExcluding": "4.4.13",
"versionStartIncluding": "2.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
"versionEndExcluding": "5.1.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Prior to this patch being applied, Mautic\u0027s tracking was vulnerable to Cross-Site Scripting through the Page URL variable."
},
{
"lang": "es",
"value": "Antes de que se aplicara este parche, el seguimiento de Mautic era vulnerable a Cross-Site Scripting a trav\u00e9s de la variable Page URL."
}
],
"id": "CVE-2024-47050",
"lastModified": "2024-09-27T15:29:21.450",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T21:15:13.743",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2024-47058
Vulnerability from fkie_nvd - Published: 2024-09-18 21:15 - Updated: 2024-09-27 15:31
Severity ?
2.9 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6555B3F-97C3-4192-BB29-BEDD3C63C4AB",
"versionEndExcluding": "4.4.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
"versionEndExcluding": "5.1.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user\u0027s current session."
},
{
"lang": "es",
"value": "Con acceso para editar un formulario de Mautic, el atacante puede agregar Cross-Site Scripting Almacenado en el archivo html. Esto podr\u00eda usarse para robar informaci\u00f3n confidencial de la sesi\u00f3n actual del usuario."
}
],
"id": "CVE-2024-47058",
"lastModified": "2024-09-27T15:31:30.917",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 0.3,
"impactScore": 2.5,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T21:15:13.923",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-25768
Vulnerability from fkie_nvd - Published: 2024-09-18 21:15 - Updated: 2025-02-27 19:39
Severity ?
7.0 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.
References
| URL | Tags | ||
|---|---|---|---|
| security@mautic.org | https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "96CCF98E-6E23-4EB5-836C-F9ADFC60AA65",
"versionEndExcluding": "4.4.13",
"versionStartIncluding": "1.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC060988-1D0C-4CB2-A052-A0BCCD236381",
"versionEndExcluding": "5.1.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required."
},
{
"lang": "es",
"value": "La l\u00f3gica implementada para facilitar el proceso de actualizaci\u00f3n a trav\u00e9s de la interfaz de usuario carece de control de acceso para verificar si existe permiso para realizar las tareas. Antes de que se aplicara este parche, era posible que un atacante accediera al n\u00famero de versi\u00f3n de Mautic o ejecutara partes del proceso de actualizaci\u00f3n sin permiso. Como la actualizaci\u00f3n en la interfaz de usuario est\u00e1 obsoleta, esta funcionalidad ya no es necesaria."
}
],
"id": "CVE-2022-25768",
"lastModified": "2025-02-27T19:39:16.353",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 4.7,
"source": "security@mautic.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-18T21:15:12.860",
"references": [
{
"source": "security@mautic.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc"
}
],
"sourceIdentifier": "security@mautic.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "security@mautic.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2024-47055 (GCVE-0-2024-47055)
Vulnerability from cvelistv5 – Published: 2025-05-28 17:34 – Updated: 2025-05-29 19:02
VLAI?
Title
Segment cloning doesn't have a proper permission check
Summary
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
Severity ?
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
Credits
Abhisek Mazumdar
Abhisek Mazumdar
Patryk Gruszka
Abhisek Mazumdar
Nick Vanpraet
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-29T19:02:39.346633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-29T19:02:53.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.2.6, \u003c 6.0.2",
"status": "affected",
"version": "\u003e 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "reporter",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nick Vanpraet"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003eThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\u003c/p\u003e\u003cp\u003eInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the \u003ccode\u003ecloneAction\u003c/code\u003e\u0026nbsp;of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\u003c/p\u003e\u003ch3\u003eMitigation\u003c/h3\u003e\u003cp\u003eUpdate Mautic to a version that implements proper authorization checks for the \u003ccode\u003ecloneAction\u003c/code\u003e\u0026nbsp;within the \u003ccode\u003eListController.php\u003c/code\u003e. Ensure that users attempting to clone segments possess the appropriate creation permissions.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\n\nInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction\u00a0of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\n\nMitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction\u00a0within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:34:32.181Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782"
}
],
"source": {
"advisory": "GHSA-vph5-ghq3-q782",
"discovery": "UNKNOWN"
},
"title": "Segment cloning doesn\u0027t have a proper permission check",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47055",
"datePublished": "2025-05-28T17:34:32.181Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-05-29T19:02:53.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47051 (GCVE-0-2024-47051)
Vulnerability from cvelistv5 – Published: 2025-02-26 12:01 – Updated: 2025-02-26 14:29
VLAI?
Title
Remote Code Execution & File Deletion in Asset Uploads
Summary
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.
* Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.
* Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
Severity ?
9.1 (Critical)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
< 5.2.3
|
Credits
mallo-m
Patryk Gruzska
Lenon Leite
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:29:14.685636Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T14:29:46.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mallo-m"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruzska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cstrong\u003eRemote Code Execution (RCE) via Asset Upload:\u003c/strong\u003e\u0026nbsp;A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cstrong\u003ePath Traversal File Deletion:\u003c/strong\u003e\u0026nbsp;A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\n\n * Remote Code Execution (RCE) via Asset Upload:\u00a0A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\n\n\n * Path Traversal File Deletion:\u00a0A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
},
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T12:01:26.374Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2"
},
{
"url": "https://owasp.org/www-community/attacks/Code_Injection"
},
{
"url": "https://owasp.org/www-community/attacks/Path_Traversal"
}
],
"source": {
"advisory": "GHSA-73gx-x7r9-77x2",
"discovery": "USER"
},
"title": "Remote Code Execution \u0026 File Deletion in Asset Uploads",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47051",
"datePublished": "2025-02-26T12:01:26.374Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-02-26T14:29:46.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47053 (GCVE-0-2024-47053)
Vulnerability from cvelistv5 – Published: 2025-02-26 11:54 – Updated: 2025-03-12 19:51
VLAI?
Title
Improper Authorization in Reporting API
Summary
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.
* Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.
Severity ?
7.7 (High)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
>= 1.0.1 , < < 5.2.3
(semver)
|
Credits
Putzwasser
Lenon Leite
Patryk Gruszka
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:43:36.534365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-12T19:51:32.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.2.3",
"status": "affected",
"version": "\u003e= 1.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Putzwasser"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses an authorization vulnerability in Mautic\u0027s HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eImproper Authorization:\u003c/strong\u003e\u0026nbsp;An authorization flaw exists in Mautic\u0027s API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the \"Reporting Permissions \u0026gt; View Own\" and \"Reporting Permissions \u0026gt; View Others\" permissions, which should restrict access to non-System Reports.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses an authorization vulnerability in Mautic\u0027s HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.\n\n * Improper Authorization:\u00a0An authorization flaw exists in Mautic\u0027s API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the \"Reporting Permissions \u003e View Own\" and \"Reporting Permissions \u003e View Others\" permissions, which should restrict access to non-System Reports."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T11:55:28.089Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8xv7-g2q3-fqgc"
},
{
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"url": "https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings"
}
],
"source": {
"advisory": "GHSA-8xv7-g2q3-fqgc",
"discovery": "USER"
},
"title": "Improper Authorization in Reporting API",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the API in Mautic. See \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings\"\u003edocumentation\u003c/a\u003e.\u003c/p\u003e"
}
],
"value": "Disable the API in Mautic. See documentation https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings ."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47053",
"datePublished": "2025-02-26T11:54:17.219Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-03-12T19:51:32.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25773 (GCVE-0-2022-25773)
Vulnerability from cvelistv5 – Published: 2025-02-26 11:48 – Updated: 2025-03-12 19:51
VLAI?
Title
Relative Path Traversal in assets file upload
Summary
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.
* Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
Severity ?
4.3 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
< 5.2.3
(semver)
|
Credits
Patryk Gruzska
Majkelstick
John Linhart
Lenon Leite
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:54:09.781777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-12T19:51:58.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Patryk Gruzska"
},
{
"lang": "en",
"type": "finder",
"value": "Majkelstick"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eImproper Limitation of a Pathname to a Restricted Directory:\u003c/strong\u003e\u0026nbsp;A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\n\n * Improper Limitation of a Pathname to a Restricted Directory:\u00a0A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T11:56:45.572Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf"
}
],
"source": {
"advisory": "GHSA-4w2w-36vm-c8hf",
"discovery": "INTERNAL"
},
"title": "Relative Path Traversal in assets file upload",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25773",
"datePublished": "2025-02-26T11:48:33.383Z",
"dateReserved": "2022-02-22T20:17:36.805Z",
"dateUpdated": "2025-03-12T19:51:58.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25770 (GCVE-0-2022-25770)
Vulnerability from cvelistv5 – Published: 2024-09-18 21:26 – Updated: 2024-09-19 14:47
VLAI?
Title
Insufficient authentication in upgrade flow
Summary
Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Severity ?
7.8 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Credits
Mattias Michaux
Zdeno Kuzmany
Mattias Michaux
John Linhart
Patryk Gruszka
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T14:47:02.190322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T14:47:14.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core-lib",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0-beta3",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1.",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Zdeno Kuzmany"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
}
],
"datePublic": "2024-09-18T20:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mautic allows you to update the application via an upgrade script.\u003cbr\u003e\u003cbr\u003eThe upgrade logic isn\u0027t shielded off correctly, which may lead to vulnerable situation.\u003cbr\u003e\u003cbr\u003eThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.\u003cbr\u003e"
}
],
"value": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn\u0027t shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:26:34.059Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Upgrade to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-qf6m-6m4g-rmrc",
"discovery": "INTERNAL"
},
"title": "Insufficient authentication in upgrade flow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25770",
"datePublished": "2024-09-18T21:26:34.059Z",
"dateReserved": "2022-02-22T20:17:36.804Z",
"dateUpdated": "2024-09-19T14:47:14.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47059 (GCVE-0-2024-47059)
Vulnerability from cvelistv5 – Published: 2024-09-18 21:19 – Updated: 2024-09-25 20:46
VLAI?
Title
Users enumeration - weak password login
Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
Severity ?
4.3 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Credits
Patryk Gruszka
John Linhart
Tomasz Kowalczyk
Rafał Kamiński
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "mautic",
"vendor": "mautic",
"versions": [
{
"lessThan": "5.1.1",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T20:45:37.083409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T20:46:12.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation verifier",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Tomasz Kowalczyk"
},
{
"lang": "en",
"type": "finder",
"value": "Rafa\u0142 Kami\u0144ski"
}
],
"datePublic": "2024-09-18T20:46:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\u003cbr\u003e\u003cbr\u003eHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\u003cbr\u003e\u003cbr\u003eThis difference could be used to perform username enumeration."
}
],
"value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration."
}
],
"impacts": [
{
"capecId": "CAPEC-575",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-575 Account Footprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T19:29:53.542Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 5.1.1 or later."
}
],
"value": "Update to 5.1.1 or later."
}
],
"source": {
"advisory": "GHSA-8vff-35qm-qjvv",
"discovery": "USER"
},
"timeline": [
{
"lang": "en",
"time": "2024-08-06T13:09:00.000Z",
"value": "Issue reported"
},
{
"lang": "en",
"time": "2024-08-06T13:10:00.000Z",
"value": "Fix proposed"
},
{
"lang": "en",
"time": "2023-09-17T12:23:00.000Z",
"value": "QA passed"
}
],
"title": "Users enumeration - weak password login",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47059",
"datePublished": "2024-09-18T21:19:26.951Z",
"dateReserved": "2024-09-17T13:41:00.585Z",
"dateUpdated": "2024-09-25T20:46:12.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-27917 (GCVE-0-2021-27917)
Vulnerability from cvelistv5 – Published: 2024-09-18 21:09 – Updated: 2024-09-19 15:40
VLAI?
Title
XSS in contact tracking and page hits report
Summary
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
Severity ?
7.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
Patryk Gruszka
Lenon Leite
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-27917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:40:34.799089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:40:48.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0-beta4",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2024-09-18T20:35:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.\u003cbr\u003e"
}
],
"value": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:09:09.987Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or later."
}
],
"value": "Update to 4.4.13 or 5.1.1 or later."
}
],
"source": {
"advisory": "GHSA-xpc5-rr39-v8v2",
"discovery": "USER"
},
"title": "XSS in contact tracking and page hits report",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2021-27917",
"datePublished": "2024-09-18T21:09:09.987Z",
"dateReserved": "2021-03-02T15:53:50.859Z",
"dateUpdated": "2024-09-19T15:40:48.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47050 (GCVE-0-2024-47050)
Vulnerability from cvelistv5 – Published: 2024-09-18 21:04 – Updated: 2024-09-19 15:41
VLAI?
Title
XSS in contact/company tracking (no authentication)
Summary
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
Mqrtin
Patryk Gruszka
Lenon Leite
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:41:10.814610Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:41:19.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 2.6.0",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mqrtin"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Prior to this patch being applied, Mautic\u0027s tracking was vulnerable to Cross-Site Scripting through the Page URL variable.\u003cbr\u003e"
}
],
"value": "Prior to this patch being applied, Mautic\u0027s tracking was vulnerable to Cross-Site Scripting through the Page URL variable."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:04:46.642Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-73gr-32wg-qhh7",
"discovery": "EXTERNAL"
},
"title": "XSS in contact/company tracking (no authentication)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47050",
"datePublished": "2024-09-18T21:04:46.642Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2024-09-19T15:41:19.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47058 (GCVE-0-2024-47058)
Vulnerability from cvelistv5 – Published: 2024-09-18 21:00 – Updated: 2024-09-19 15:42
VLAI?
Title
Cross-site Scripting (XSS) - stored (edit form HTML field)
Summary
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
MatisAct
Lenon Leite
John Linhart
Avikarsha Saha
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:42:03.651742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:42:11.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MatisAct"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Avikarsha Saha"
}
],
"datePublic": "2024-09-18T20:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user\u0027s current session.\u003cbr\u003e"
}
],
"value": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user\u0027s current session."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:00:28.950Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1."
}
],
"value": "Update to 4.4.13 or 5.1.1."
}
],
"source": {
"advisory": "GHSA-xv68-rrmw-9xwf",
"discovery": "UNKNOWN"
},
"title": "Cross-site Scripting (XSS) - stored (edit form HTML field)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47058",
"datePublished": "2024-09-18T21:00:28.950Z",
"dateReserved": "2024-09-17T13:41:00.585Z",
"dateUpdated": "2024-09-19T15:42:11.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25768 (GCVE-0-2022-25768)
Vulnerability from cvelistv5 – Published: 2024-09-18 20:55 – Updated: 2024-09-19 15:42
VLAI?
Title
Improper Access Control in UI upgrade process
Summary
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.
Severity ?
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
Credits
Mattias Michaux
Patryk Gruszka
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:42:37.075391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:42:44.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.1.3",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2024-09-18T17:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\u003c/p\u003e"
}
],
"value": "The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T20:55:53.187Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-x3jx-5w6m-q2fc",
"discovery": "USER"
},
"title": "Improper Access Control in UI upgrade process",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25768",
"datePublished": "2024-09-18T20:55:53.187Z",
"dateReserved": "2022-02-22T20:17:36.803Z",
"dateUpdated": "2024-09-19T15:42:44.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47055 (GCVE-0-2024-47055)
Vulnerability from nvd – Published: 2025-05-28 17:34 – Updated: 2025-05-29 19:02
VLAI?
Title
Segment cloning doesn't have a proper permission check
Summary
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
Severity ?
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
Credits
Abhisek Mazumdar
Abhisek Mazumdar
Patryk Gruszka
Abhisek Mazumdar
Nick Vanpraet
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-29T19:02:39.346633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-29T19:02:53.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.2.6, \u003c 6.0.2",
"status": "affected",
"version": "\u003e 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "reporter",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Abhisek Mazumdar"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nick Vanpraet"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003eThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\u003c/p\u003e\u003cp\u003eInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the \u003ccode\u003ecloneAction\u003c/code\u003e\u0026nbsp;of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\u003c/p\u003e\u003ch3\u003eMitigation\u003c/h3\u003e\u003cp\u003eUpdate Mautic to a version that implements proper authorization checks for the \u003ccode\u003ecloneAction\u003c/code\u003e\u0026nbsp;within the \u003ccode\u003eListController.php\u003c/code\u003e. Ensure that users attempting to clone segments possess the appropriate creation permissions.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\n\nInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction\u00a0of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\n\nMitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction\u00a0within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T17:34:32.181Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782"
}
],
"source": {
"advisory": "GHSA-vph5-ghq3-q782",
"discovery": "UNKNOWN"
},
"title": "Segment cloning doesn\u0027t have a proper permission check",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47055",
"datePublished": "2025-05-28T17:34:32.181Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-05-29T19:02:53.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47051 (GCVE-0-2024-47051)
Vulnerability from nvd – Published: 2025-02-26 12:01 – Updated: 2025-02-26 14:29
VLAI?
Title
Remote Code Execution & File Deletion in Asset Uploads
Summary
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.
* Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.
* Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
Severity ?
9.1 (Critical)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
< 5.2.3
|
Credits
mallo-m
Patryk Gruzska
Lenon Leite
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:29:14.685636Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T14:29:46.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mallo-m"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruzska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cstrong\u003eRemote Code Execution (RCE) via Asset Upload:\u003c/strong\u003e\u0026nbsp;A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cstrong\u003ePath Traversal File Deletion:\u003c/strong\u003e\u0026nbsp;A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\n\n * Remote Code Execution (RCE) via Asset Upload:\u00a0A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\n\n\n * Path Traversal File Deletion:\u00a0A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
},
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T12:01:26.374Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2"
},
{
"url": "https://owasp.org/www-community/attacks/Code_Injection"
},
{
"url": "https://owasp.org/www-community/attacks/Path_Traversal"
}
],
"source": {
"advisory": "GHSA-73gx-x7r9-77x2",
"discovery": "USER"
},
"title": "Remote Code Execution \u0026 File Deletion in Asset Uploads",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47051",
"datePublished": "2025-02-26T12:01:26.374Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-02-26T14:29:46.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47053 (GCVE-0-2024-47053)
Vulnerability from nvd – Published: 2025-02-26 11:54 – Updated: 2025-03-12 19:51
VLAI?
Title
Improper Authorization in Reporting API
Summary
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.
* Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.
Severity ?
7.7 (High)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
>= 1.0.1 , < < 5.2.3
(semver)
|
Credits
Putzwasser
Lenon Leite
Patryk Gruszka
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:43:36.534365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-12T19:51:32.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.2.3",
"status": "affected",
"version": "\u003e= 1.0.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Putzwasser"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses an authorization vulnerability in Mautic\u0027s HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eImproper Authorization:\u003c/strong\u003e\u0026nbsp;An authorization flaw exists in Mautic\u0027s API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the \"Reporting Permissions \u0026gt; View Own\" and \"Reporting Permissions \u0026gt; View Others\" permissions, which should restrict access to non-System Reports.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses an authorization vulnerability in Mautic\u0027s HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.\n\n * Improper Authorization:\u00a0An authorization flaw exists in Mautic\u0027s API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the \"Reporting Permissions \u003e View Own\" and \"Reporting Permissions \u003e View Others\" permissions, which should restrict access to non-System Reports."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T11:55:28.089Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8xv7-g2q3-fqgc"
},
{
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"url": "https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings"
}
],
"source": {
"advisory": "GHSA-8xv7-g2q3-fqgc",
"discovery": "USER"
},
"title": "Improper Authorization in Reporting API",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the API in Mautic. See \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings\"\u003edocumentation\u003c/a\u003e.\u003c/p\u003e"
}
],
"value": "Disable the API in Mautic. See documentation https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings ."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47053",
"datePublished": "2025-02-26T11:54:17.219Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2025-03-12T19:51:32.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25773 (GCVE-0-2022-25773)
Vulnerability from nvd – Published: 2025-02-26 11:48 – Updated: 2025-03-12 19:51
VLAI?
Title
Relative Path Traversal in assets file upload
Summary
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.
* Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
Severity ?
4.3 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mautic | mautic/core |
Affected:
< 5.2.3
(semver)
|
Credits
Patryk Gruzska
Majkelstick
John Linhart
Lenon Leite
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T14:54:09.781777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-12T19:51:58.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "mautic/core",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Patryk Gruzska"
},
{
"lang": "en",
"type": "finder",
"value": "Majkelstick"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
}
],
"datePublic": "2025-02-25T11:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eImproper Limitation of a Pathname to a Restricted Directory:\u003c/strong\u003e\u0026nbsp;A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.\n\n * Improper Limitation of a Pathname to a Restricted Directory:\u00a0A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T11:56:45.572Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf"
}
],
"source": {
"advisory": "GHSA-4w2w-36vm-c8hf",
"discovery": "INTERNAL"
},
"title": "Relative Path Traversal in assets file upload",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25773",
"datePublished": "2025-02-26T11:48:33.383Z",
"dateReserved": "2022-02-22T20:17:36.805Z",
"dateUpdated": "2025-03-12T19:51:58.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25770 (GCVE-0-2022-25770)
Vulnerability from nvd – Published: 2024-09-18 21:26 – Updated: 2024-09-19 14:47
VLAI?
Title
Insufficient authentication in upgrade flow
Summary
Mautic allows you to update the application via an upgrade script.
The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.
This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Severity ?
7.8 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Credits
Mattias Michaux
Zdeno Kuzmany
Mattias Michaux
John Linhart
Patryk Gruszka
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T14:47:02.190322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T14:47:14.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core-lib",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0-beta3",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1.",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Zdeno Kuzmany"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
}
],
"datePublic": "2024-09-18T20:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mautic allows you to update the application via an upgrade script.\u003cbr\u003e\u003cbr\u003eThe upgrade logic isn\u0027t shielded off correctly, which may lead to vulnerable situation.\u003cbr\u003e\u003cbr\u003eThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.\u003cbr\u003e"
}
],
"value": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn\u0027t shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:26:34.059Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Upgrade to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-qf6m-6m4g-rmrc",
"discovery": "INTERNAL"
},
"title": "Insufficient authentication in upgrade flow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25770",
"datePublished": "2024-09-18T21:26:34.059Z",
"dateReserved": "2022-02-22T20:17:36.804Z",
"dateUpdated": "2024-09-19T14:47:14.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47059 (GCVE-0-2024-47059)
Vulnerability from nvd – Published: 2024-09-18 21:19 – Updated: 2024-09-25 20:46
VLAI?
Title
Users enumeration - weak password login
Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
Severity ?
4.3 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Credits
Patryk Gruszka
John Linhart
Tomasz Kowalczyk
Rafał Kamiński
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "mautic",
"vendor": "mautic",
"versions": [
{
"lessThan": "5.1.1",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T20:45:37.083409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T20:46:12.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation verifier",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Tomasz Kowalczyk"
},
{
"lang": "en",
"type": "finder",
"value": "Rafa\u0142 Kami\u0144ski"
}
],
"datePublic": "2024-09-18T20:46:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\u003cbr\u003e\u003cbr\u003eHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\u003cbr\u003e\u003cbr\u003eThis difference could be used to perform username enumeration."
}
],
"value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration."
}
],
"impacts": [
{
"capecId": "CAPEC-575",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-575 Account Footprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T19:29:53.542Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 5.1.1 or later."
}
],
"value": "Update to 5.1.1 or later."
}
],
"source": {
"advisory": "GHSA-8vff-35qm-qjvv",
"discovery": "USER"
},
"timeline": [
{
"lang": "en",
"time": "2024-08-06T13:09:00.000Z",
"value": "Issue reported"
},
{
"lang": "en",
"time": "2024-08-06T13:10:00.000Z",
"value": "Fix proposed"
},
{
"lang": "en",
"time": "2023-09-17T12:23:00.000Z",
"value": "QA passed"
}
],
"title": "Users enumeration - weak password login",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47059",
"datePublished": "2024-09-18T21:19:26.951Z",
"dateReserved": "2024-09-17T13:41:00.585Z",
"dateUpdated": "2024-09-25T20:46:12.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-27917 (GCVE-0-2021-27917)
Vulnerability from nvd – Published: 2024-09-18 21:09 – Updated: 2024-09-19 15:40
VLAI?
Title
XSS in contact tracking and page hits report
Summary
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
Severity ?
7.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
Patryk Gruszka
Lenon Leite
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-27917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:40:34.799089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:40:48.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0-beta4",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2024-09-18T20:35:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.\u003cbr\u003e"
}
],
"value": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:09:09.987Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or later."
}
],
"value": "Update to 4.4.13 or 5.1.1 or later."
}
],
"source": {
"advisory": "GHSA-xpc5-rr39-v8v2",
"discovery": "USER"
},
"title": "XSS in contact tracking and page hits report",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2021-27917",
"datePublished": "2024-09-18T21:09:09.987Z",
"dateReserved": "2021-03-02T15:53:50.859Z",
"dateUpdated": "2024-09-19T15:40:48.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47050 (GCVE-0-2024-47050)
Vulnerability from nvd – Published: 2024-09-18 21:04 – Updated: 2024-09-19 15:41
VLAI?
Title
XSS in contact/company tracking (no authentication)
Summary
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
Mqrtin
Patryk Gruszka
Lenon Leite
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:41:10.814610Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:41:19.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 2.6.0",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mqrtin"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Prior to this patch being applied, Mautic\u0027s tracking was vulnerable to Cross-Site Scripting through the Page URL variable.\u003cbr\u003e"
}
],
"value": "Prior to this patch being applied, Mautic\u0027s tracking was vulnerable to Cross-Site Scripting through the Page URL variable."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:04:46.642Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-73gr-32wg-qhh7",
"discovery": "EXTERNAL"
},
"title": "XSS in contact/company tracking (no authentication)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47050",
"datePublished": "2024-09-18T21:04:46.642Z",
"dateReserved": "2024-09-17T13:41:00.584Z",
"dateUpdated": "2024-09-19T15:41:19.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47058 (GCVE-0-2024-47058)
Vulnerability from nvd – Published: 2024-09-18 21:00 – Updated: 2024-09-19 15:42
VLAI?
Title
Cross-site Scripting (XSS) - stored (edit form HTML field)
Summary
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
Credits
MatisAct
Lenon Leite
John Linhart
Avikarsha Saha
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:42:03.651742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:42:11.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.0.0",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MatisAct"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lenon Leite"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Avikarsha Saha"
}
],
"datePublic": "2024-09-18T20:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user\u0027s current session.\u003cbr\u003e"
}
],
"value": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user\u0027s current session."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T21:00:28.950Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1."
}
],
"value": "Update to 4.4.13 or 5.1.1."
}
],
"source": {
"advisory": "GHSA-xv68-rrmw-9xwf",
"discovery": "UNKNOWN"
},
"title": "Cross-site Scripting (XSS) - stored (edit form HTML field)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2024-47058",
"datePublished": "2024-09-18T21:00:28.950Z",
"dateReserved": "2024-09-17T13:41:00.585Z",
"dateUpdated": "2024-09-19T15:42:11.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-25768 (GCVE-0-2022-25768)
Vulnerability from nvd – Published: 2024-09-18 20:55 – Updated: 2024-09-19 15:42
VLAI?
Title
Improper Access Control in UI upgrade process
Summary
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.
Severity ?
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
Credits
Mattias Michaux
Patryk Gruszka
John Linhart
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-25768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T15:42:37.075391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:42:44.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "mautic/core",
"product": "Mautic",
"repo": "https://github.com/mautic/mautic",
"vendor": "Mautic",
"versions": [
{
"lessThan": "\u003c 4.4.13",
"status": "affected",
"version": "\u003e= 1.1.3",
"versionType": "semver"
},
{
"lessThan": "\u003c 5.1.1",
"status": "affected",
"version": "\u003e= 5.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mattias Michaux"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Patryk Gruszka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John Linhart"
}
],
"datePublic": "2024-09-18T17:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\u003c/p\u003e"
}
],
"value": "The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T20:55:53.187Z",
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic"
},
"references": [
{
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"value": "Update to 4.4.13 or 5.1.1 or higher."
}
],
"source": {
"advisory": "GHSA-x3jx-5w6m-q2fc",
"discovery": "USER"
},
"title": "Improper Access Control in UI upgrade process",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"assignerShortName": "Mautic",
"cveId": "CVE-2022-25768",
"datePublished": "2024-09-18T20:55:53.187Z",
"dateReserved": "2022-02-22T20:17:36.803Z",
"dateUpdated": "2024-09-19T15:42:44.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}