CVE Feed

    Dashboard / CVE / CVE-2017-1000490

    CVE-2017-1000490

    Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

    Published:Jan 3, 2018
    Last Modified:Nov 21, 2024
    EPS:Jan 3, 2018
    EPSS Score:0.00344
    CVSS Score:6.5

    Affected Products

    Vendor
    Acquia
    Product
    Mautic
    Vendor
    Mautic
    Product
    Mautic

    Exploits

    https://github.com/mautic/mautic/releases/tag/2.12.0https://github.com/mautic/mautic/releases/tag/2.12.0

    Related CVEs

    CVE-2026-3105 (CVSS 7.6) — SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a…
    CVE-2024-47055 (CVSS 4.3) — SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality…
    CVE-2024-47051 (CVSS 9.1) — This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These v…
    CVE-2024-47053 (CVSS 7.7) — This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. T…
    CVE-2022-25773 (CVSS 4.3) — This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di…
    CVE-2022-25770 (CVSS 7.8) — Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre…
    CVE-2024-47059 (CVSS 4.3) — When logging in with the correct username and incorrect weak password, the user receives the notification, tha…
    CVE-2021-27917 (CVSS 7.3) — Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.…
    CVE-2024-47050 (CVSS 5.4) — Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U…
    CVE-2024-47058 (CVSS 2.9) — With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High