Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14M2p4LTV3Nm0tcTJmY84AA_rI

Mautic vulnerable to Improper Access Control in UI upgrade process

Impact

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Patches

Upgrade to 4.4.13 or 5.1.1 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-x3jx-5w6m-q2fc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14M2p4LTV3Nm0tcTJmY84AA_rI
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago


CVSS Score: 7.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS Percentage: 0.00043
EPSS Percentile: 0.10511

Identifiers: GHSA-x3jx-5w6m-q2fc, CVE-2022-25768
References: Repository: https://github.com/mautic/mautic
Blast Radius: 13.5

Affected Packages

packagist:mautic/core
Dependent packages: 2
Dependent repositories: 3
Downloads: 2,009 total
Affected Version Ranges: >= 5.0.0-alpha, < 5.1.1, >= 1.1.3, < 4.4.13
Fixed in: 5.1.1, 4.4.13
All affected versions: 1.1.3, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 2.9.1, 2.9.2, 2.10.0, 2.10.1, 2.11.0, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.14.0, 2.14.1, 2.14.2, 2.15.0, 2.15.1, 2.15.2, 2.15.3, 2.16.0, 2.16.1, 2.16.2, 2.16.3, 2.16.4, 2.16.5, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 5.0.0, 5.0.0-alpha, 5.0.0-alpha1, 5.0.0-beta1, 5.0.0-beta2, 5.0.0-rc1, 5.0.0-rc2, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0
All unaffected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 4.4.13, 5.1.1, 5.2.0, 5.2.1
packagist:mautic/core-lib
Dependent packages: 56
Dependent repositories: 85
Downloads: 44,674 total
Affected Version Ranges: >= 5.0.0-alpha, < 5.1.1, >= 1.1.3, < 4.4.13
Fixed in: 5.1.1, 4.4.13
All affected versions: 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 5.0.0, 5.0.0-alpha, 5.0.0-alpha1, 5.0.0-beta1, 5.0.0-beta2, 5.0.0-rc1, 5.0.0-rc2, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0
All unaffected versions: 4.4.13, 5.1.1, 5.2.0, 5.2.1