CVE-2024-3448CWE-918

Improper Access Control Leads to Server-Side Request Forgery in Mautic

Medium · published April 10, 2024

CVSS v3.1
5.0
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-04-10T13:59Z
EPSS history
Timeline
  • 10 APR 13:59Z
    Improper Access Control Leads to Server-Side Request Forgery in Mautic
    cvelistv5