PT-2024-11534 · Mautic · Mautic

John Linhart + 3 · Published 2024-09-18 · Updated 2024-09-20 · CVE-2022-25768

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1

Description The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to the patch being applied, it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Recommendations Upgrade to version 4.4.13 or later. Upgrade to version 5.1.1 or later. As a temporary workaround, consider disabling the update process via the user interface until a patch is applied.

Fix

Improper Access Control

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-284

CWE-287

CWE-862

Related Identifiers

CVE-2022-25768

GHSA-X3JX-5W6M-Q2FC

Affected Products

Mautic

References · 10

• https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25768 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3jx-5w6m-q2fc · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b · Note
• https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce · Note
• https://t.me/cvenotify/95163 · Telegram Post
• https://t.me/cvedetector/6032 · Telegram Post
• https://twitter.com/CVEnew/status/1836534049654927852 · Twitter Post