Read the docs
TI-2018-07222 Aliases CVE-2018-10189GHSA-vfxj-qg93-7wwc

An issue was discovered in Mautic 1.x and 2.x before 2.13.0.

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

Why it matters now

EPSS 0.01136 66th percentileScored 2026-11-07
Fix Fixed mautic/core (Packagist): 2.13.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mautic/core (Packagist)before 2.13.02.13.0Patch availableGHSA-vfxj-qg93-7wwc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mautic/core (Packagist) Vendor— Affected before 2.13.0 Fixed in 2.13.0 Patch available GHSA-vfxj-qg93-7wwc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:*1.0.0 – 1.4.1; 2.0.0 to before 2.13.0VulnerableMautic
  • cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.1; 2.0.0 to before 2.13.0 Vulnerable ·Mautic

Remediation

  • Fix · GHSA-vfxj-qg93-7wwc mautic/core (Packagist) Fixed in 2.13.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10189
  2. 2026-10-03 Alias added: GHSA-vfxj-qg93-7wwc

References

Advisory 2

Other 1

  • TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
  • TI-2020-17841 Mautic before 3.2.4 is affected by stored XSS. CVSS 3.1CRITICAL 9.0
  • TI-2017-14698 Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to… CVSS 3.0HIGH 8.1
  • TI-2017-14388 Mautic 2.6.1 and earlier fails to set flags on session cookies CVSS 3.0HIGH 7.5
  • TI-2017-14699 Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user… CVSS 3.0MEDIUM 6.5
  • TI-2018-05838 Mautic before v2.13.0 has stored XSS via a theme config file. CVSS 3.0MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences