GitHub Advisoryadvisory · Packagist

GHSA-6x98-fx9j-7c78 Disabled users able to log in with third party SSO plugin

HIGH Published 2021-01-19 Modified 2023-09-11 Official page ↗
Aliases
CVE-2017-1000489
Ecosystem
Packagist
Packages
mautic/core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2021-01-19

Affected packages

• Packagist mautic/core: >= 2.0.0, < 2.12.0 → fixed in 2.12.0

Description

Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Patches Upgrade to 2.12.0 or later. Workarounds None. For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2017-1000489 Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References