CVE-2024-47055: Segment cloning doesn't have a proper permission check
Summary This advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
Mitigation Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
Workarounds None
If you have any questions or comments about this advisory: Email us at security@mautic.org
Other sources
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47055?
CVE-2024-47055 has a medium severity rating due to the potential for unauthorized segment cloning by authenticated users.
How do I fix CVE-2024-47055?
To fix CVE-2024-47055, update to Mautic versions 6.0.2 or 5.2.6 or later.
What is the nature of the vulnerability in CVE-2024-47055?
CVE-2024-47055 is an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to clone segments without proper authorization.
Who is affected by CVE-2024-47055?
CVE-2024-47055 affects all versions of Mautic prior to 6.0.2 and 5.2.6.
What actions should I take if I am using a vulnerable version of Mautic related to CVE-2024-47055?
If using a vulnerable version, immediately upgrade to the fixed versions (6.0.2 or 5.2.6) to mitigate the risk.