PT-2018-5254 · Mautic · Mautic

Pahan12 · Published 2018-01-03 · Updated 2021-01-25 · CVE-2017-1000490

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions 1.0.0 through 2.11.0

Description The issue allows any authorized Mautic user session to use the Filemanager to download any file from the server that the web user has access to, given that the user is logged into Mautic.

Recommendations Update to version 2.12.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-1000490

GHSA-QPGW-2C72-4C89

Affected Products

Mautic

References · 7

• 🔥 https://github.com/mautic/mautic/releases/tag/2.12.0 · Exploit
• https://osv.dev/vulnerability/CVE-2017-1000490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpgw-2c72-4c89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000490 · Security Note
• https://github.com/mautic/mautic/security/advisories/GHSA-qpgw-2c72-4c89 · Note
• https://github.com/mautic/mautic/commit/3b01786433ae15e9a23f1eb9b0d3dfdb065b6241 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000490 · Note