Read the docs
TI-2021-09248 Aliases CVE-2021-27913GHSA-x7g2-wrrp-r6h3

Use of a Broken or Risky Cryptographic Algorithm

Priority LOW 17CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.

Why it matters now

EPSS 0.00458 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Mautic (Mautic): 3.3.4, 4.0.0mautic/core (Packagist): 3.3.4, 4.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MauticMauticbefore 3.3.4; before 4.0.03.3.4, 4.0.0Patch availableCNA
—mautic/core (Packagist)before 3.3.43.3.4Patch availableGHSA-x7g2-wrrp-r6h3
—mautic/core (Packagist)4.0.0-alpha1 to before 4.0.04.0.0Patch availableGHSA-x7g2-wrrp-r6h3
  • Mautic VendorMautic Affected before 3.3.4; before 4.0.0 Fixed in 3.3.4, 4.0.0 Patch available CNA
  • mautic/core (Packagist) Vendor— Affected before 3.3.4 Fixed in 3.3.4 Patch available GHSA-x7g2-wrrp-r6h3
  • mautic/core (Packagist) Vendor— Affected 4.0.0-alpha1 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-x7g2-wrrp-r6h3

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*before 3.3.4VulnerableAcquia
cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*4.0.0 alpha1VulnerableAcquia
cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*4.0.0 betaVulnerableAcquia
cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*4.0.0 rcVulnerableAcquia
  • cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions before 3.3.4 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Acquia
  • cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:* Versions 4.0.0 rc Vulnerable ·Acquia

Remediation

  • Fix · CNA Mautic (Mautic) Fixed in 3.3.4, 4.0.0
  • Fix · GHSA-x7g2-wrrp-r6h3 mautic/core (Packagist) Fixed in 3.3.4 Advisory →
  • Fix · GHSA-x7g2-wrrp-r6h3 mautic/core (Packagist) Fixed in 4.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mautic 3.3.4, 4.0.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2021-09246 XSS vulnerability on contacts viewPriority LOW 37
    • TI-2021-09245 Stored XSS vulnerability on Bounce Management CallbackPriority LOW 37
    • TI-2021-09244 XSS vulnerability on password reset pagePriority LOW 35
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27913
  2. 2026-10-03 Alias added: GHSA-x7g2-wrrp-r6h3

References

Exploit 1

Advisory 1

Other 3

  • TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
  • TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
  • TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
  • TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
  • TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
  • TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences