CVE-2024-2731
Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic
- State
- Published
- Severity
- 5.4 Medium
- Published
- Apr 10, 2024
- Updated
- Aug 1, 2024
- Reserved
- Mar 20, 2024
Description
Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and monitoring campaigns and their descriptions. In addition, unprivileged users can see and edit the descriptions of tags. At the time of publication of the CVE no patch is available.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NCSC.ch |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
MauticMautic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.