SB2021011932 - Multiple vulnerabilities in Mautic
Published: January 19, 2021 Updated: May 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2017-1000490)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Filemanager when handling file download requests. A remote user can request arbitrary files accessible to the web server user to disclose sensitive information.
The user must be logged into Mautic to exploit this issue.
2) Improper access control (CVE-ID: CVE-2017-1000489)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass account disablement and log in.
The vulnerability exists due to improper access control in the third-party SSO plugin integration when processing SSO authentication for a disabled account using an email address. A remote user can authenticate via a linked email address to bypass account disablement and log in.
Only installations with an SSO plugin installed are vulnerable.
3) Cross-site scripting (CVE-ID: CVE-2017-1000488)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.
The vulnerability exists due to cross-site scripting in Mautic forms on a Mautic landing page when using GET parameters to pre-populate the form. A remote attacker can supply specially crafted GET parameters to execute arbitrary script code in the victim's browser.
Remediation
Install update from vendor's website.