Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Mautic < 4.4.12, < 5.0.4 Clear all filters
TI-2022-09349 CVE-2022-25777 · GHSA-mgv8-w49f-822w

Server-Side Request Forgery in Asset section

Priority LOW 29

Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00445 Published 2024-09-18 Fixed in < 4.4.12, < 5.0.4 +2 CWE-918
TI-2022-09348 CVE-2022-25776 · GHSA-qjx3-2g35-6hv8

Sensitive Data Exposure due to inadequate user permission settings

Priority LOW 36

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00396 Published 2024-09-18 Fixed in < 4.4.12, < 5.0.4 +2 CWE-276
TI-2022-09347 CVE-2022-25775 · GHSA-jj6w-2cqg-7p94

SQL Injection in dynamic Reports

Priority LOW 34

Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00593 Published 2024-09-18 Fixed in < 4.4.12, < 5.0.4 +2 CWE-89