User name enumeration possible due to response time difference on password reset form
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-203.
Summary
SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack. MitigationPlease update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mautic | Mautic | > 1.0 to before < 6.0.2, < 5.2.6, < 4.4.16 | < 6.0.2, < 5.2.6, < 4.4.16 | Patch available | CNA |
| — | mautic/core (Packagist) | 1.0.0 to before 4.4.16 | 4.4.16 | Patch available | GHSA-424x-cxvh-wq9p |
| — | mautic/core (Packagist) | 5.0.0-alpha to before 5.2.6 | 5.2.6 | Patch available | GHSA-424x-cxvh-wq9p |
| — | mautic/core (Packagist) | 6.0.0-alpha to before 6.0.2 | 6.0.2 | Patch available | GHSA-424x-cxvh-wq9p |
- Mautic VendorMautic Affected > 1.0 to before < 6.0.2, < 5.2.6, < 4.4.16 Fixed in < 6.0.2, < 5.2.6, < 4.4.16 Patch available CNA
- mautic/core (Packagist) Vendor— Affected 1.0.0 to before 4.4.16 Fixed in 4.4.16 Patch available GHSA-424x-cxvh-wq9p
- mautic/core (Packagist) Vendor— Affected 5.0.0-alpha to before 5.2.6 Fixed in 5.2.6 Patch available GHSA-424x-cxvh-wq9p
- mautic/core (Packagist) Vendor— Affected 6.0.0-alpha to before 6.0.2 Fixed in 6.0.2 Patch available GHSA-424x-cxvh-wq9p
Remediation
- Fix · CNA Mautic (Mautic) Fixed in < 6.0.2, < 5.2.6, < 4.4.16
- Fix · GHSA-424x-cxvh-wq9p mautic/core (Packagist) Fixed in 4.4.16 Advisory →
- Fix · GHSA-424x-cxvh-wq9p mautic/core (Packagist) Fixed in 5.2.6 Advisory →
- Fix · GHSA-424x-cxvh-wq9p mautic/core (Packagist) Fixed in 6.0.2 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mautic < 6.0.2, < 5.2.6, < 4.4.16
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-04720 Open Redirect vulnerability on user unlock pathPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47057
- 2026-10-03 Alias added: GHSA-424x-cxvh-wq9p
References
More Mautic vulnerabilities
- TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
- TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
- TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
- TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
- TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
- TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-47057 · CVE Program
- CVE-2024-47057 · NVD
- FIRST EPSS
- GHSA-424x-cxvh-wq9p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences