Kurz gesagt
- CVE-2025-13828 ist eine Schwachstelle (KRITISCH (CVSS 9.0)) in mautic/core.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.25%, höher als bei 16.2% aller Schwachstellen.
- Abhilfe: auf 4.4.18, 5.2.9, 6.0.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| mautic/core Packagist | ≥ 4.0.0, < 4.4.18≥ 5.0.0, < 5.2.9≥ 6.0.0, < 6.0.7
| 4.4.185.2.96.0.7
|
Description
Summary
A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
Impact
A low-privileged user of the platform can install malicious code to obtain higher privileges.
NVD description
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free