Mautic up to 5.2.5/6.0.1 Segment Cloning authorization

Summaryinfo

A vulnerability identified as problematic has been detected in Mautic up to 5.2.5/6.0.1. This vulnerability affects unknown code of the component Segment Cloning. The manipulation leads to authorization. This vulnerability is referenced as CVE-2024-47055. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Mautic up to 5.2.5/6.0.1. It has been rated as problematic. This issue affects some unknown functionality of the component Segment Cloning. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. The summary by CVE is:

SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks. Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones. MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.

The weakness was published by Abhisek Mazumdar as GHSA-vph5-ghq3-q782. The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-47055 since 09/17/2024. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 5.2.6 or 6.0.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Mautic

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 6.0.0
• 6.0.1

License

• open-source

Website

• Product: https://github.com/mautic/mautic/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion