PT-2025-23098 · Apache+2 · Apache+2
Lenon Leite
+3
·
Published
2025-05-28
·
Updated
2025-06-02
·
CVE-2024-47056
CVSS v3.1
5.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Mautic (affected versions not specified)
Description
The issue concerns the potential exposure of sensitive information, including database credentials, API keys, and other critical system configurations, due to the direct accessibility of .env configuration files via a web browser. This is caused by missing web server configurations that restrict access to such files, allowing an unauthenticated attacker to view the contents of the .env file by navigating to its URL.
Recommendations
Update Mautic to the latest version.
For Apache users: Ensure your web server is configured to respect .htaccess files.
For Nginx users: Add a configuration block to your Nginx server configuration to deny access to .env files by including the following in your Nginx configuration for the Mautic site:
location ~ /.env {
deny all;
}
After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache
Mautic
Nginx