PT-2025-23115 · Mautic · Mautic

Abhisek Mazumdar + 2 · Published 2025-05-28 · Updated 2025-05-30 · CVE-2024-47055

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

Recommendations Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php, ensuring that users attempting to clone segments possess the appropriate creation permissions.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-47055

GHSA-VPH5-GHQ3-Q782

Affected Products

Mautic

References · 7

• https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47055 · Security Note
• https://osv.dev/vulnerability/GHSA-vph5-ghq3-q782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47055 · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://t.me/cvetracker/25047 · Telegram Post
• https://twitter.com/CVEnew/status/1927784570197274878 · Twitter Post