CVE-2024-47059mediumCWE-200

CVE-2024-47059: falha de média gravidade em Mautic

Users enumeration - weak password login

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Mautic+ Monitorar mautic/core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Mautic · Mautic
CVEs relacionadas — Mautic

No mesmo produto, das mais perigosas para as menos.

CVE-2022-25772CRITICALCVE-2022-25772EPSS 63.0%CVE-2021-27909MEDIUMXSS vulnerability on password reset pageEPSS 4.1%CVE-2021-27916HIGHRelative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)EPSS 0.8%CVE-2021-27910HIGHStored XSS vulnerability on Bounce Management CallbackEPSS 0.7%CVE-2021-27911HIGHXSS vulnerability on contacts viewEPSS 0.6%CVE-2021-27915HIGHXSS Cross-site Scripting Stored (XSS) - Description fieldEPSS 0.6%