Patryk Gruszka

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** An SQL injection occurs in the API contact filtering mechanism. This issue arises from insufficient recursive sanitization of nested query parameters, allowing an authenticated API user to bypass input filtering and execute arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the Document Object Model (DOM) as option fields. An authenticated user with project creation permissions can store a malicious script payload in a project name. When an administrative user opens an entity editor containing the project selector, the script executes in their browser session, potentially leading to session hijacking, unauthorized state coordination, or unauthorized access to organizational data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the Projects component. When administrative detail views for campaigns, emails, or forms display project tags and popovers, user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can inject malicious script payloads. When an administrator hovers over a tag associated with a compromised project, the script executes in their browser session, potentially allowing the attacker to perform administrative actions, change system configurations, or exfiltrate sensitive data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as `viewown` or `editown`, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries. **Recommendations** Update to version 7.1.2. Temporarily revoke API credentials or narrow access permissions for users whose roles rely on owner-scope permission containment.

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** A path traversal flaw exists in the campaign import feature. During the extraction of uploaded ZIP files, a validation error allows file paths to exit the designated temporary directories. An authenticated user with `campaign:imports:create` privileges can write arbitrary PHP files to sensitive system directories, potentially overwriting internal configuration or cache components. This can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, under the context of the web server user. **Recommendations** Update to version 7.1.2. Revoke `campaign:imports:create` permissions from non-administrative users.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 Mautic versions prior to 6.0.9 Mautic versions prior to 5.2.11 Mautic versions prior to 4.4.20 **Description** A Server-Side Template Injection (SSTI) issue exists in the theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can exploit this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings. **Recommendations** Update to version 7.1.2. Update to version 6.0.9. Update to version 5.2.11. Update to version 4.4.20. Restrict theme upload and creation permissions `core:themes:create` to only highly trusted administrators.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A Server-Side Request Forgery (SSRF) exists in the Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server. This allows for internal network reconnaissance or forcing requests to arbitrary internal or external destinations. SSRF is a flaw where an attacker can abuse server functionality to read or update internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GrapesJS (affected versions not specified) **Description** The GrapesJS Builder allows the upload of arbitrary files due to a lack of file type restrictions. If the media folder is not configured to prevent file execution, this could lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A user with limited privileges can bypass restrictions related to Composer and install or remove packages. This can occur even if the platform's update settings have Composer-based updates disabled. This allows a low-privileged user to potentially install malicious code and escalate their privileges on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to the version that properly validates or sanitizes the returnUrl parameter **Description** The issue is related to an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists in the "/s/action/unlock/user.user/0" endpoint, where the `returnUrl` parameter is not properly validated, allowing an attacker to craft a URL that redirects users to an arbitrary external website. **Recommendations** Update Mautic to a version that properly validates or sanitizes the `returnUrl` parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains. As a temporary workaround, consider restricting access to the `/s/action/unlock/user.user/0` endpoint to minimize the risk of exploitation. Avoid using the `returnUrl` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** A security issue exists in the "Forget your password" functionality of Mautic, allowing unauthenticated users to enumerate valid usernames through a timing-based attack. This is due to differences in response times for existing and non-existing users, combined with a lack of request limiting. **Recommendations** Update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones. **Recommendations** Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php, ensuring that users attempting to clone segments possess the appropriate creation permissions.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns the potential exposure of sensitive information, including database credentials, API keys, and other critical system configurations, due to the direct accessibility of .env configuration files via a web browser. This is caused by missing web server configurations that restrict access to such files, allowing an unauthenticated attacker to view the contents of the .env file by navigating to its URL. **Recommendations** Update Mautic to the latest version. For Apache users: Ensure your web server is configured to respect .htaccess files. For Nginx users: Add a configuration block to your Nginx server configuration to deny access to .env files by including the following in your Nginx configuration for the Mautic site: location ~ /.env { deny all; } After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue concerns an authorization flaw in Mautic's HTTP Basic Authentication implementation, allowing unauthorized access to sensitive report data. Specifically, an improper authorization flaw exists in Mautic's API Authorization implementation, enabling any authenticated user to access all reports and their associated data via the API, bypassing intended access controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The upgrade logic in Mautic's application update via an upgrade script is not properly shielded, potentially leading to a vulnerable situation. However, this issue is mitigated by the fact that Mautic must be installed in a specific way to be vulnerable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** A stored XSS issue existed in the contact tracking and page hits report, allowing for potential malicious script execution. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 5.1.1 **Description** The application responds differently when logging in with a correct username and incorrect weak password versus an incorrect username and weak password. This difference could be used to perform username enumeration. When a correct username is used with an incorrect weak password, the user receives a notification stating that their password is too weak. In contrast, when an incorrect username is provided alongside a weak password, the application responds with an 'Invalid credentials' notification. **Recommendations** Update to version 5.1.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to the patch being applied, it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required. **Recommendations** Upgrade to version 4.4.13 or later. Upgrade to version 5.1.1 or later. As a temporary workaround, consider disabling the update process via the user interface until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** The issue concerns Cross-Site Scripting through the `Page URL` variable in Mautic's tracking. This allows for potential exploitation. **Recommendations** For versions prior to 4.4.13, update to 4.4.13 or later. For versions prior to 5.1.1, update to 5.1.1 or later. As a temporary workaround, consider restricting the use of the `Page URL` variable in Mautic's tracking until a patch is applied.