Mautic Sensitive Data Exposure due to inadequate user permission settings

中 6.5CVE-2022-25776 · GHSA-qjx3-2g35-6hv8 · 18/09/2024 公開 · 17/06/2026 更新

要点

CVE-2022-25776 は mautic/core, mautic (acquia) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.40%（全脆弱性の 33.9% より高い）。
対処：4.4.12, 5.0.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
mautic/core Packagist	`≥ 1.0.2, < 4.4.12≥ 5.0.0-alpha, < 5.0.4`	`4.4.125.0.4`
mautic acquia	`≥ 1.0.2, < 4.4.12≥ 5.0.0, < 5.0.4`	`4.4.125.0.4`

概要

Impact

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.

Users could potentially access sensitive data such as names and surnames, company names and stage names.

Patches

Update to 4.4.12 and 5.0.4

Workarounds

References

https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure

NVD の説明

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.