PT-2018-5254 · Mautic · Mautic

Pahan12 · Publicado 2018-01-03 · Atualizado 2021-01-25 · CVE-2017-1000490

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions 1.0.0 through 2.11.0

Description The issue allows any authorized Mautic user session to use the Filemanager to download any file from the server that the web user has access to, given that the user is logged into Mautic.

Recommendations Update to version 2.12.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-1000490

GHSA-QPGW-2C72-4C89

Produtos afetados

Mautic

Referências · 7

• 🔥 https://github.com/mautic/mautic/releases/tag/2.12.0 · Exploit
• https://github.com/mautic/mautic/security/advisories/GHSA-qpgw-2c72-4c89 · Nota
• https://github.com/mautic/mautic/commit/3b01786433ae15e9a23f1eb9b0d3dfdb065b6241 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000490 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000490 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qpgw-2c72-4c89 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000490 · Nota de Segurança