CVE-2017-1000490: Path Traversal
Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.
Patches Update to 2.12.0 or later.
Workarounds None
For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000490?
The severity of CVE-2017-1000490 is medium with a CVSS score of 6.5.
How does CVE-2017-1000490 affect Mautic?
CVE-2017-1000490 allows any logged-in Mautic user to download any file from the server that they have access to using the Filemanager.
How can I fix CVE-2017-1000490?
To fix CVE-2017-1000490, update Mautic to version 2.12.0 or later.
Are there any workarounds for CVE-2017-1000490?
No, there are no workarounds for CVE-2017-1000490.
Where can I find more information about CVE-2017-1000490?
You can find more information about CVE-2017-1000490 at the following references: [Reference 1](https://github.com/mautic/mautic/security/advisories/GHSA-qpgw-2c72-4c89), [Reference 2](https://nvd.nist.gov/vuln/detail/CVE-2017-1000490), [Reference 3](https://github.com/mautic/mautic/commit/3b01786433ae15e9a23f1eb9b0d3dfdb065b6241).