CVE-2025-9821 (GCVE-0-2025-9821)
Vulnerability from cvelistv5
Published
2025-09-03 09:39
Modified
2025-09-03 14:12
Severity ?
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Summary
SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/  for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html  for more information on SSRF and its fix.
References
security@mautic.orghttps://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69
Impacted products
Vendor Product Version
Mautic Mautic Version: >= 4.4.0   ≤ < 4.4.17
Version: >= 5.0.0-alpha   ≤ < 5.2.8
Version: >= 6.0.0-alpha   ≤ < 6.0.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T14:07:29.437694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T14:12:35.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "product": "Mautic",
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "versions": [
            {
              "lessThanOrEqual": "\u003c 4.4.17",
              "status": "affected",
              "version": "\u003e= 4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c 5.2.8",
              "status": "affected",
              "version": "\u003e= 5.0.0-alpha",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c 6.0.5",
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "asesidaa"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "lukehebe"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "patrykgruszka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "kuzmany"
        }
      ],
      "datePublic": "2025-09-03T08:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003eUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\u003c/p\u003e\u003ch3\u003eDetails\u003c/h3\u003e\u003cp\u003eWhen sending webhooks, the destination is not validated, causing SSRF.\u003cbr\u003e\u003c/p\u003e\u003ch3\u003eImpact\u003c/h3\u003e\u003cp\u003eBypass of firewalls to interact with internal services.\u003cbr\u003eSee \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\"\u003ehttps://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\u003c/a\u003e\u0026nbsp;for more potential impact.\u003c/p\u003e\u003ch3\u003eResources\u003c/h3\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\"\u003ehttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\u003c/a\u003e\u0026nbsp;for more information on SSRF and its fix.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\n\nDetailsWhen sending webhooks, the destination is not validated, causing SSRF.\n\n\nImpactBypass of firewalls to interact with internal services.\nSee  https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ \u00a0for more potential impact.\n\nResources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html \u00a0for more information on SSRF and its fix."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-03T09:39:01.005Z",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69"
        }
      ],
      "source": {
        "advisory": "GHSA-hj6f-7hp7-xg69",
        "discovery": "UNKNOWN"
      },
      "title": "SSRF via webhook function",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2025-9821",
    "datePublished": "2025-09-03T09:39:01.005Z",
    "dateReserved": "2025-09-02T08:22:33.758Z",
    "dateUpdated": "2025-09-03T14:12:35.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-9821\",\"sourceIdentifier\":\"security@mautic.org\",\"published\":\"2025-09-03T10:15:38.133\",\"lastModified\":\"2025-09-04T15:36:56.447\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\\n\\nDetailsWhen sending webhooks, the destination is not validated, causing SSRF.\\n\\n\\nImpactBypass of firewalls to interact with internal services.\\nSee  https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ \u00a0for more potential impact.\\n\\nResources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html \u00a0for more information on SSRF and its fix.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":2.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69\",\"source\":\"security@mautic.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9821\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-03T14:07:29.437694Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-03T14:08:18.907Z\"}}], \"cna\": {\"title\": \"SSRF via webhook function\", \"source\": {\"advisory\": \"GHSA-hj6f-7hp7-xg69\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"asesidaa\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"lukehebe\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"patrykgruszka\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"kuzmany\"}], \"impacts\": [{\"capecId\": \"CAPEC-664\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-664 Server Side Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 2.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/mautic/mautic\", \"vendor\": \"Mautic\", \"product\": \"Mautic\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c 4.4.17\"}, {\"status\": \"affected\", \"version\": \"\u003e= 5.0.0-alpha\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c 5.2.8\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0-alpha\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c 6.0.5\"}], \"packageName\": \"mautic/core\", \"collectionURL\": \"https://packagist.org\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-09-03T08:56:00.000Z\", \"references\": [{\"url\": \"https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\\n\\nDetailsWhen sending webhooks, the destination is not validated, causing SSRF.\\n\\n\\nImpactBypass of firewalls to interact with internal services.\\nSee  https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ \\u00a0for more potential impact.\\n\\nResources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html \\u00a0for more information on SSRF and its fix.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003eUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\u003c/p\u003e\u003ch3\u003eDetails\u003c/h3\u003e\u003cp\u003eWhen sending webhooks, the destination is not validated, causing SSRF.\u003cbr\u003e\u003c/p\u003e\u003ch3\u003eImpact\u003c/h3\u003e\u003cp\u003eBypass of firewalls to interact with internal services.\u003cbr\u003eSee \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\\\"\u003ehttps://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\u003c/a\u003e\u0026nbsp;for more potential impact.\u003c/p\u003e\u003ch3\u003eResources\u003c/h3\u003e\u003cp\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\\\"\u003ehttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\u003c/a\u003e\u0026nbsp;for more information on SSRF and its fix.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"4e531c38-7a33-45d3-98dd-d909c0d8852e\", \"shortName\": \"Mautic\", \"dateUpdated\": \"2025-09-03T09:39:01.005Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-9821\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-03T14:12:35.814Z\", \"dateReserved\": \"2025-09-02T08:22:33.758Z\", \"assignerOrgId\": \"4e531c38-7a33-45d3-98dd-d909c0d8852e\", \"datePublished\": \"2025-09-03T09:39:01.005Z\", \"assignerShortName\": \"Mautic\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.