CVE-2024-47059: Mautic allows users enumeration due to weak password login
Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
Patches
Update to 5.1.1 or later.
If you have any questions or comments about this advisory:
Email us at security@mautic.org
Other sources
Mautic allows users enumeration due to weak password login
— Packagist
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 5.1.1 - Upgrade
Upgrade
Mauticto a version that resolves this vulnerability.Fixed in 5.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47059?
CVE-2024-47059 has a moderate severity level due to issues related to weak password validation.
How do I fix CVE-2024-47059?
To fix CVE-2024-47059, update Mautic core to version 5.1.2 or later to enhance password validation mechanisms.
What impact does CVE-2024-47059 have on user authentication?
CVE-2024-47059 can allow attackers to exploit weak password implementations during authentication attempts.
Is CVE-2024-47059 being actively exploited?
As of now, there are no public reports indicating that CVE-2024-47059 is actively being exploited.
What versions of Mautic are affected by CVE-2024-47059?
CVE-2024-47059 affects Mautic core versions between 5.1.0 and 5.1.1 inclusive.