CVE-2022-25770: Mautic Core Insufficient Authentication in Upgrade Flow
Summary
CVE-2022-25770: Duplicate Advisory: Mautic has insufficient authentication in upgrade flow. Affects mautic/core across 2 version ranges.
>= 1.0.0-beta3, < 4.4.13
>= 5.0.0, < 5.1.1
Fixed in 4.4.13 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage and automate their marketing campaigns. It provides features such as email marketing, lead management, and campaign tracking. The application is designed to be flexible and extensible, allowing users to customize their marketing strategies. However, Mautic has a vulnerability in its upgrade flow that can lead to unauthorized access if not properly managed.
Vulnerability Detail
Mautic's upgrade script does not adequately protect the upgrade logic, which can expose the application to unauthorized updates or modifications. This vulnerability arises from insufficient authentication checks during the upgrade process, potentially allowing attackers to exploit the system if Mautic is installed in a vulnerable configuration. The consequences of this vulnerability include unauthorized access to sensitive data and the ability to execute arbitrary code, leading to a compromise of the entire application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0-beta3, < 4.4.134.4.13composer require mautic/core:4.4.13 -
>= 5.0.0, < 5.1.15.1.1composer require mautic/core:5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the upgrade script is not accessible to unauthorized users. This can be achieved by restricting access to the upgrade directory or by implementing additional authentication mechanisms until the application is updated.
Conclusion
The CVE-2022-25770 vulnerability in Mautic poses significant risks due to insufficient authentication in the upgrade flow. Users are strongly advised to upgrade to the latest versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for mautic/core →
FAQ
CVE-2022-25770 is a vulnerability in Mautic that allows insufficient authentication during the upgrade process, potentially leading to unauthorized access.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized access to sensitive data, the ability to execute arbitrary code, and a complete compromise of the Mautic application.
Mautic versions prior to 4.4.13 and 5.1.1 are affected by this vulnerability.
If an immediate upgrade is not possible, restrict access to the upgrade script and implement additional security measures to protect your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
