github - ghsa-hj6f-7hp7-xg69

ghsa-hj6f-7hp7-xg69

Vulnerability from github

Published

2025-09-03 22:11

Modified

2025-09-03 22:11

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

Mautic vulnerable to SSRF via webhook function

Details

Summary

Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

Details

When sending webhooks, the destination is not validated, causing SSRF.

Impact

Bypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.

Resources

https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-alpha"
            },
            {
              "fixed": "5.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0-alpha"
            },
            {
              "fixed": "6.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-9821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-03T22:11:32Z",
    "nvd_published_at": "2025-09-03T10:15:38Z",
    "severity": "LOW"
  },
  "details": "### Summary\nUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\n\n### Details\nWhen sending webhooks, the destination is not validated, causing SSRF.\n\n### Impact\nBypass of firewalls to interact with internal services. \nSee https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.\n\n### Resources\nhttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix",
  "id": "GHSA-hj6f-7hp7-xg69",
  "modified": "2025-09-03T22:11:32Z",
  "published": "2025-09-03T22:11:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9821"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mautic vulnerable to SSRF via webhook function"
}

CVE-2025-9821 (GCVE-0-2025-9821)

Vulnerability from cvelistv5

Published

2025-09-03 09:39

Modified

2025-09-03 14:12

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix.

References

▼	URL	Tags
	https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69

Impacted products

	Vendor	Product	Version
	Mautic	Mautic	Version: >= 4.4.0 ≤ < 4.4.17 Version: >= 5.0.0-alpha ≤ < 5.2.8 Version: >= 6.0.0-alpha ≤ < 6.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T14:07:29.437694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T14:12:35.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "product": "Mautic",
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "versions": [
            {
              "lessThanOrEqual": "\u003c 4.4.17",
              "status": "affected",
              "version": "\u003e= 4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c 5.2.8",
              "status": "affected",
              "version": "\u003e= 5.0.0-alpha",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c 6.0.5",
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "asesidaa"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "lukehebe"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "patrykgruszka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "kuzmany"
        }
      ],
      "datePublic": "2025-09-03T08:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ch3\u003eSummary\u003c/h3\u003e\u003cp\u003eUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\u003c/p\u003e\u003ch3\u003eDetails\u003c/h3\u003e\u003cp\u003eWhen sending webhooks, the destination is not validated, causing SSRF.\u003cbr\u003e\u003c/p\u003e\u003ch3\u003eImpact\u003c/h3\u003e\u003cp\u003eBypass of firewalls to interact with internal services.\u003cbr\u003eSee \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\"\u003ehttps://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\u003c/a\u003e\u0026nbsp;for more potential impact.\u003c/p\u003e\u003ch3\u003eResources\u003c/h3\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\"\u003ehttps://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\u003c/a\u003e\u0026nbsp;for more information on SSRF and its fix.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed\n\nDetailsWhen sending webhooks, the destination is not validated, causing SSRF.\n\n\nImpactBypass of firewalls to interact with internal services.\nSee  https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ \u00a0for more potential impact.\n\nResources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html \u00a0for more information on SSRF and its fix."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-03T09:39:01.005Z",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69"
        }
      ],
      "source": {
        "advisory": "GHSA-hj6f-7hp7-xg69",
        "discovery": "UNKNOWN"
      },
      "title": "SSRF via webhook function",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2025-9821",
    "datePublished": "2025-09-03T09:39:01.005Z",
    "dateReserved": "2025-09-02T08:22:33.758Z",
    "dateUpdated": "2025-09-03T14:12:35.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-hj6f-7hp7-xg69

Vulnerability from github

Summary

Details

Impact

Resources

CVE-2025-9821 (GCVE-0-2025-9821)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature