CVE-2024-2731 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic
Low-privilege users can view sensitive company and user data and edit tag descriptions due to improper access control in Mautic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2731?
CVE-2024-2731 is a medium-severity missing authorization vulnerability in Mautic, published on 10 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and monitoring campaigns and their descriptions. In addition, unprivileged users can see and edit the descriptions of tags. At the time of publication of the CVE no patch is available.
Weakness: CWE-284
Which versions are affected by CVE-2024-2731?
How do I fix CVE-2024-2731?
No fix has been published for CVE-2024-2731 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-2731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2731 exists.
Sources
Also known as GHSA-hh28-wc7c-m2r4.