Skip to main content

Missing Authorization

CVE-2024-47055

Medium
4.3/10

Summary

This advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks. A missing authorization vulnerability exists in the "cloneAction" of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones. Update Mautic to a version that implements proper authorization checks for the "cloneAction" within the "ListController.php". Ensure that users attempting to clone segments possess the appropriate creation permissions. This issue affects mautic/core and mautic/core-lib versions 5.0.x prior to 5.2.6 and 6.0.x prior to 6.0.2.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published