PT-2024-11537 · Mautic · Mautic

A-Solovev + 4 · Published 2024-04-12 · Updated 2024-09-23 · CVE-2022-25775

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4

Description The issue affects logged in users of Mautic, making them vulnerable to an SQL injection vulnerability in the Reports bundle. This vulnerability allows an attacker to retrieve and alter sensitive data, including login information. Depending on the database permissions, the attacker may also be able to manipulate file systems.

Recommendations Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the Reports bundle until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-25775

GHSA-JJ6W-2CQG-7P94

Affected Products

Mautic

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-25775 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25775 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj6w-2cqg-7p94 · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/e75b1eea16309588f069169b5882cf53f854dbd8 · Note
• https://github.com/mautic/mautic/commit/cab65e0acc4f23c4f07c117dee1b69dac5abed3f · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-jj6w-2cqg-7p94 · Note
• https://twitter.com/CVEnew/status/1836424254793155063 · Twitter Post
• https://t.me/cvenotify/95771 · Telegram Post