github - ghsa-8vff-35qm-qjvv

GHSA-8VFF-35QM-QJVV

Vulnerability from github – Published: 2024-09-18 22:10 – Updated: 2024-09-19 21:48

Summary

Mautic allows users enumeration due to weak password login

Details

Summary

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.

Patches

Update to 5.1.1 or later.

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-18T22:10:05Z",
    "nvd_published_at": "2024-09-18T22:15:04Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided along side with weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration.\n\n### Patches\n\nUpdate to 5.1.1 or later.\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@mautic.org](mailto:security@mautic.org)",
  "id": "GHSA-8vff-35qm-qjvv",
  "modified": "2024-09-19T21:48:35Z",
  "published": "2024-09-18T22:10:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mautic allows users enumeration due to weak password login"
}

CVE-2024-47059 (GCVE-0-2024-47059)

Vulnerability from cvelistv5 – Published: 2024-09-18 21:19 – Updated: 2024-09-25 20:46

Summary

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

Mautic

References

URL

Tags

https://github.com/mautic/mautic/security/advisor…

Impacted products

	Vendor	Product	Version
	Mautic	Mautic	Affected: >= 5.1.0 , < < 5.1.1 (semver)

Credits

Patryk Gruszka John Linhart Tomasz Kowalczyk Rafał Kamiński

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "mautic",
            "vendor": "mautic",
            "versions": [
              {
                "lessThan": "5.1.1",
                "status": "affected",
                "version": "5.1.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47059",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T20:45:37.083409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T20:46:12.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "product": "Mautic",
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "versions": [
            {
              "lessThan": "\u003c 5.1.1",
              "status": "affected",
              "version": "\u003e= 5.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Patryk Gruszka"
        },
        {
          "lang": "en",
          "type": "remediation verifier",
          "value": "John Linhart"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tomasz Kowalczyk"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Rafa\u0142 Kami\u0144ski"
        }
      ],
      "datePublic": "2024-09-18T20:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\u003cbr\u003e\u003cbr\u003eHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\u003cbr\u003e\u003cbr\u003eThis difference could be used to perform username enumeration."
            }
          ],
          "value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-575",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-575 Account Footprinting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-19T19:29:53.542Z",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 5.1.1 or later."
            }
          ],
          "value": "Update to 5.1.1 or later."
        }
      ],
      "source": {
        "advisory": "GHSA-8vff-35qm-qjvv",
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-08-06T13:09:00.000Z",
          "value": "Issue reported"
        },
        {
          "lang": "en",
          "time": "2024-08-06T13:10:00.000Z",
          "value": "Fix proposed"
        },
        {
          "lang": "en",
          "time": "2023-09-17T12:23:00.000Z",
          "value": "QA passed"
        }
      ],
      "title": "Users enumeration - weak password login",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2024-47059",
    "datePublished": "2024-09-18T21:19:26.951Z",
    "dateReserved": "2024-09-17T13:41:00.585Z",
    "dateUpdated": "2024-09-25T20:46:12.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8VFF-35QM-QJVV

Summary

Patches

CVE-2024-47059 (GCVE-0-2024-47059)

Tags

Sightings

Nomenclature