CVE-2018-10189: Infoleak
Impact An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.
Patches Update to 2.13.0 or later
Workarounds None
For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-10189?
CVE-2018-10189 is a vulnerability in the Mautic software version 2.x before 2.13.0 that allows a third party to manipulate tracking cookies and assume being tracked.
What is the impact of CVE-2018-10189?
The impact of CVE-2018-10189 is that a third party can systematically emulate tracking cookies per contact and manipulate the cookie value.
How can the vulnerability CVE-2018-10189 be exploited?
The vulnerability CVE-2018-10189 can be exploited by manipulating the cookie value with +1 to assume being tracked.
How can I fix the vulnerability CVE-2018-10189?
To fix the vulnerability CVE-2018-10189, you need to update Mautic to version 2.13.0 or later.
Where can I find more information about CVE-2018-10189?
You can find more information about CVE-2018-10189 on the GitHub security advisory page and the NIST National Vulnerability Database.