PT-2024-25931 · Mautic · Mautic

Published 2024-04-10 · Updated 2024-04-10 · CVE-2024-3448

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software name or versions are mentioned in the provided descriptions.

Description The issue allows users with low privileges to perform certain AJAX actions, leading to improper access to "ajax?action=plugin:focus:checkIframeAvailability". This results in a Server-Side Request Forgery, enabling an attacker to perform a port scan in the back-end by analyzing error messages returned from the back-end.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-3448

Affected Products

Mautic

References · 5

• 🔥 https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3448 · Security Note
• https://twitter.com/CVEnew/status/1778118946907914367 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1778098368809496815 · Twitter Post
• https://t.me/cvenotify/76272 · Telegram Post