GHSA-VFXJ-QG93-7WWC高危已审查

Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID

OSV 1.4.0 · github-reviewed · 修改于 2023-09-11 23:06

发布时间

2021-01-20 05:16

GitHub 审查时间

2021-01-20 05:13

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/01/GHSA-vfxj-qg93-7wwc/GHSA-vfxj-qg93-7wwc.json

公告说明

Impact

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

Patches

Update to 2.13.0 or later

Workarounds

None

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

受影响的软件包

Packagist

mautic/core

ECOSYSTEM

标识信息

别名 / CVE

CVE-2018-10189

CWE

CWE-200

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-vfxj-qg93-7wwc",
  "aliases": [
    "CVE-2018-10189"
  ],
  "details": "### Impact\nAn issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.\n\n### Patches\nUpdate to 2.13.0 or later\n\n### Workarounds\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [[email protected]](mailto:[email protected])",
  "summary": "Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0"
            }
          ]
        }
      ],
      "package": {
        "name": "mautic/core",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2023-09-11T15:06:08Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2021-01-19T21:16:21Z",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-vfxj-qg93-7wwc",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10189",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/mautic/mautic/releases/tag/2.13.0",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-01-19T21:13:34Z"
  }
}