PT-2022-17501 · Mautic · Mautic

John Linhart + 3 · Published 2022-03-01 · Updated 2024-09-20 · CVE-2022-25769

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 3.3.5 Mautic versions prior to 4.2.0

Description The default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. However, the regex in the second FilesMatch only checks the filename, not the full path, which is incorrect logic. This issue can enable local host attacks due to an improper validation flaw.

Recommendations For Mautic versions prior to 3.3.5, please upgrade to version 3.3.5 or later. For Mautic versions prior to 4.2.0, please upgrade to version 4.2.0 or later. As a temporary workaround, consider restricting access to the .htaccess file until a patch is applied.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2022-25769

GHSA-MJ6M-246H-9W56

Affected Products

Mautic

References · 7

• https://osv.dev/vulnerability/GHSA-mj6m-246h-9w56 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25769 · Security Note
• https://github.com/mautic/mautic/security/advisories/GHSA-mj6m-246h-9w56 · Note
• https://twitter.com/oktsec/status/1836459573378470378 · Twitter Post
• https://mautic.org/blog/community/mautic-4-2-one-small-step-mautic · Note
• https://twitter.com/CVEnew/status/1836424260396683504 · Twitter Post