CVE-2024-47053: Mautic Core Improper Authorization in Reporting API
Summary
CVE-2024-47053: Mautic allows Improper Authorization in Reporting API. Affects mautic/core versions >= 1.0.1, < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns, track customer interactions, and analyze data to improve marketing strategies. It provides features such as email marketing, landing pages, and reporting tools. However, a significant vulnerability has been identified in its Reporting API, which could expose sensitive report data to unauthorized users.
Vulnerability Detail
The vulnerability arises from an improper authorization flaw in Mautic's HTTP Basic Authentication implementation. This issue allows any authenticated user, regardless of their assigned roles or permissions, to access all reports and their associated data through the API. This bypasses the intended access controls set by the 'Reporting Permissions > View Own' and 'Reporting Permissions > View Others' permissions, which are designed to restrict access to non-System Reports. The ramifications of this vulnerability include unauthorized access to sensitive data, potentially leading to data breaches and privacy violations.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require mautic/core:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the API in Mautic to prevent unauthorized access. This can be done by navigating to the API settings in the Mautic configuration and turning off the API feature. For detailed instructions, refer to the Mautic documentation: https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings.
Conclusion
The CVE-2024-47053 vulnerability in Mautic's Reporting API poses a significant risk due to improper authorization, allowing unauthorized users to access sensitive data. It is crucial to update to version 5.2.3 or later to mitigate this risk. In the meantime, disabling the API can serve as a temporary workaround.
See every vulnerability recorded for mautic/core →
FAQ
CVE-2024-47053 is a vulnerability in Mautic's Reporting API that allows unauthorized access to sensitive report data due to improper authorization.
If you are using a version of Mautic prior to 5.2.3, your installation is vulnerable. You can check your version in the Mautic dashboard.
If an immediate update is not possible, consider disabling the API as a temporary workaround to prevent unauthorized access.
The risks include unauthorized access to sensitive report data, which could lead to data breaches and privacy violations.
More information can be found in the Mautic documentation and the advisory details at https://cwe.mitre.org/data/definitions/285.html.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
