GitHub Advisoryadvisory · Packagist

GHSA-qpgw-2c72-4c89 Mautic users able to download any files from server using filemanager

MEDIUM Published 2021-01-19 Modified 2023-09-11 Official page ↗
Aliases
CVE-2017-1000490
Ecosystem
Packagist
Packages
mautic/core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2021-01-19

Affected packages

• Packagist mautic/core: >= 1.0.0, < 2.12.0 → fixed in 2.12.0

Description

Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to. Patches Update to 2.12.0 or later. Workarounds None For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2017-1000490 Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References