github - ghsa-438m-6mhw-hq5w

ghsa-438m-6mhw-hq5w

Vulnerability from github

Published

2025-09-03 22:18

Modified

2025-09-03 22:18

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Summary

Mautic vulnerable to secret data extraction via elfinder

Details

Summary

A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.

Impact

An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-alpha"
            },
            {
              "fixed": "5.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0-alpha"
            },
            {
              "fixed": "6.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-9822"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-283"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-03T22:18:20Z",
    "nvd_published_at": "2025-09-03T14:15:46Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n_A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._\n\n\n### Impact\n_An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them._",
  "id": "GHSA-438m-6mhw-hq5w",
  "modified": "2025-09-03T22:18:20Z",
  "published": "2025-09-03T22:18:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9822"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/882c2c5be646e36f7b91e7c4b24f71aafa617cd5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/a310b1933de7cfefec03382a4d8c0d9dbbaa0600"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mautic vulnerable to secret data extraction via elfinder"
}

CVE-2025-9822 (GCVE-0-2025-9822)

Vulnerability from cvelistv5

Published

2025-09-03 13:55

Modified

2025-09-03 14:09

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-283

Summary

SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

References

▼	URL	Tags
	https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w

Impacted products

	Vendor	Product	Version
	Mautic	Mautic	Version: >= 4.4.0 ≤ Version: >= 5.0.0-alpha ≤ Version: >= 6.0.0-alpha ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T14:08:49.982448Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T14:09:46.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "product": "Mautic",
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "versions": [
            {
              "lessThan": "\u003c 4.4.17",
              "status": "affected",
              "version": "\u003e= 4.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "\u003c 5.2.8",
              "status": "affected",
              "version": "\u003e= 5.0.0-alpha",
              "versionType": "semver"
            },
            {
              "lessThan": "\u003c 6.0.5",
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "B0D0B0P0T"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "lenonleite"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "kuzmany"
        }
      ],
      "datePublic": "2025-09-03T08:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003e\u003cem\u003eA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.\u003c/em\u003e\u003c/p\u003e\u003ch3\u003eImpact\u003c/h3\u003e\u003cp\u003e\u003cem\u003eAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.\u003c/em\u003e\u003c/p\u003e"
            }
          ],
          "value": "SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.\n\nImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-283",
              "description": "CWE-283",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-03T13:55:12.870Z",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w"
        }
      ],
      "source": {
        "advisory": "GHSA-438m-6mhw-hq5w",
        "discovery": "EXTERNAL"
      },
      "title": "Secret data extraction via elfinder",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2025-9822",
    "datePublished": "2025-09-03T13:55:12.870Z",
    "dateReserved": "2025-09-02T08:22:34.513Z",
    "dateUpdated": "2025-09-03T14:09:46.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-438m-6mhw-hq5w

Vulnerability from github

Summary

Impact

CVE-2025-9822 (GCVE-0-2025-9822)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature