Nick Vanpraet

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting attacks. Recommendations: For versions 0.0.0 through 4.2.1, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns the potential exposure of sensitive information, including database credentials, API keys, and other critical system configurations, due to the direct accessibility of .env configuration files via a web browser. This is caused by missing web server configurations that restrict access to such files, allowing an unauthenticated attacker to view the contents of the .env file by navigating to its URL. **Recommendations** Update Mautic to the latest version. For Apache users: Ensure your web server is configured to respect .htaccess files. For Nginx users: Add a configuration block to your Nginx server configuration to deny access to .env files by including the following in your Nginx configuration for the Mautic site: location ~ /.env { deny all; } After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones. **Recommendations** Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php, ensuring that users attempting to clone segments possess the appropriate creation permissions.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A security issue exists in the "Forget your password" functionality of Mautic, allowing unauthenticated users to enumerate valid usernames through a timing-based attack. This is due to differences in response times for existing and non-existing users, combined with a lack of request limiting. **Recommendations** Update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to the version that properly validates or sanitizes the returnUrl parameter **Description** The issue is related to an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists in the "/s/action/unlock/user.user/0" endpoint, where the `returnUrl` parameter is not properly validated, allowing an attacker to craft a URL that redirects users to an arbitrary external website. **Recommendations** Update Mautic to a version that properly validates or sanitizes the `returnUrl` parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains. As a temporary workaround, consider restricting access to the `/s/action/unlock/user.user/0` endpoint to minimize the risk of exploitation. Avoid using the `returnUrl` parameter in the affected endpoint until the issue is resolved.