GitHub Advisoryadvisory · Packagist

GHSA-vfxj-qg93-7wwc Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID

HIGH Published 2021-01-19 Modified 2023-09-11 Official page ↗
Aliases
CVE-2018-10189
Ecosystem
Packagist
Packages
mautic/core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2021-01-19

Affected packages

• Packagist mautic/core: < 2.13.0 → fixed in 2.13.0

Description

Impact An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled. Patches Update to 2.13.0 or later Workarounds None For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2018-10189 An issue was discovered in Mautic 1.x and 2.x before 2.13.0. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References