PT-2025-36623 · Packagist · Mautic/Core

Publicado 2025-09-03 · Atualizado 2025-09-03

OSV

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

Details

When sending webhooks, the destination is not validated, causing SSRF.

Impact

Bypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10 2021-Server-Side Request Forgery %28SSRF%29/ for more potential impact.

Resources

https://cheatsheetseries.owasp.org/cheatsheets/Server Side Request Forgery Prevention Cheat Sheet.html for more information on SSRF and its fix

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

GHSA-HJ6F-7HP7-XG69

Produtos afetados

Mautic/Core

Referências · 6

• https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69 · Nota
• https://github.com/mautic/mautic · Nota
• https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba · Nota
• https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9821 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hj6f-7hp7-xg69 · Aviso do Fabricante