Sensitive Data Exposure in Mautic Core
Summary
CVE-2022-25776: Mautic Sensitive Data Exposure due to inadequate user permission settings. Affects mautic/core across 2 version ranges.
>= 1.0.2, < 4.4.12
>= 5.0.0-alpha, < 5.0.4
Fixed in 4.4.12 or 5.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic Core is an open-source marketing automation software that allows users to manage and track marketing campaigns. It provides features such as email marketing, lead management, and campaign tracking. The software is widely used by businesses to automate their marketing processes and engage with customers. However, a vulnerability has been identified in Mautic Core that could lead to sensitive data exposure.
Vulnerability Detail
The vulnerability in Mautic Core allows logged-in users to access areas of the application that they should be restricted from. This means that users with lower privileges can potentially access sensitive data, including names, surnames, company names, and stage names. This vulnerability poses a risk to the confidentiality of user data and can lead to unauthorized access and misuse of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.2, < 4.4.124.4.12composer require mautic/core:4.4.12 -
>= 5.0.0-alpha, < 5.0.45.0.4composer require mautic/core:5.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the provided patches or update to the latest version of Mautic Core to address the issue effectively.
Conclusion
The vulnerability in Mautic Core exposes sensitive data to unauthorized users. To ensure the security of user information, it is recommended to update Mautic Core to version 4.4.12 or 5.0.4. These patched versions address the vulnerability and prevent unauthorized access to sensitive data. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mautic/core →
FAQ
The vulnerability allows logged-in users to access restricted areas and sensitive data, compromising the confidentiality of user information.
Users of Mautic Core versions prior to 4.4.12 and 5.0.4 are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the patched versions is the recommended solution.
To update Mautic Core, follow the instructions provided by the Mautic documentation or consult with your system administrator.
There is no evidence of exploitation of this vulnerability at the time of this advisory. However, it is crucial to apply the patches as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
