Nick Vanpraet

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting attacks. Recommendations: For versions 0.0.0 through 4.2.1, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

The issue concerns the potential exposure of sensitive information, including database credentials, API keys, and other critical system configurations, due to the direct accessibility of .env configuration files via a web browser. This is caused by missing web server configurations that restrict access to such files, allowing an unauthenticated attacker to view the contents of the .env file by navigating to its URL.

The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

A security issue exists in the "Forget your password" functionality of Mautic, allowing unauthenticated users to enumerate valid usernames through a timing-based attack. This is due to differences in response times for existing and non-existing users, combined with a lack of request limiting.

The issue is related to an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists in the "/s/action/unlock/user.user/0" endpoint, where the `returnUrl` parameter is not properly validated, allowing an attacker to craft a URL that redirects users to an arbitrary external website.