CVE-2022-25768: Mautic Core Library Improper Access Control Vulnerability
Summary
CVE-2022-25768: Mautic vulnerable to Improper Access Control in UI upgrade process. Affects mautic/core-lib across 2 version ranges.
>= 1.1.3, < 4.4.13
>= 5.0.0-alpha, < 5.1.1
Fixed in 4.4.13 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns effectively. It provides features such as email marketing, lead management, and campaign tracking. The core library of Mautic is essential for its functionality, handling various operations and processes. However, a recent vulnerability has been identified that compromises the security of the upgrade process via the user interface.
Vulnerability Detail
The vulnerability arises from improper access control in the Mautic user interface during the upgrade process. The existing logic does not adequately verify user permissions, potentially allowing unauthorized users to access sensitive information, such as the Mautic version number, or execute parts of the upgrade process without appropriate permissions. This could lead to unauthorized changes or exposure of critical system information, posing a significant risk to the integrity and security of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.1.3, < 4.4.134.4.13composer require mautic/core-lib:4.4.13 -
>= 5.0.0-alpha, < 5.1.15.1.1composer require mautic/core-lib:5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The best course of action is to apply the recommended patches by upgrading to the specified versions.
Conclusion
In summary, CVE-2022-25768 is a significant vulnerability in the Mautic core library that affects the upgrade process due to improper access control. Users are strongly advised to upgrade to the latest versions to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mautic/core-lib →
FAQ
CVE-2022-25768 is a vulnerability in the Mautic core library that involves improper access control during the UI upgrade process.
The risks include unauthorized access to sensitive information and the ability for attackers to execute upgrade processes without permission, which could compromise the integrity of the application.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected. Simply upload your composer.lock file or use the Vulert playground without signup.
Versions prior to 4.4.13 and 5.1.1 of the Mautic core library are affected by this vulnerability.
Unfortunately, there are no workarounds available. The only effective solution is to upgrade to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core-lib.
