CVE-2024-47059: Users enumeration - weak password login
First published: Wed Sep 18 2024(Updated: )
### Summary When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration. ### Patches Update to 5.1.1 or later. If you have any questions or comments about this advisory: Email us at [security@mautic.org](mailto:security@mautic.org)
Credit: security@mautic.org security@mautic.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/mautic/core | >=5.1.0<5.1.1 | 5.1.1 |
| Mautic | =5.1.0 |
Remedy
Update to 5.1.1 or later.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-47059?
CVE-2024-47059 has a moderate severity level due to issues related to weak password validation.
How do I fix CVE-2024-47059?
To fix CVE-2024-47059, update Mautic core to version 5.1.2 or later to enhance password validation mechanisms.
What impact does CVE-2024-47059 have on user authentication?
CVE-2024-47059 can allow attackers to exploit weak password implementations during authentication attempts.
Is CVE-2024-47059 being actively exploited?
As of now, there are no public reports indicating that CVE-2024-47059 is actively being exploited.
What versions of Mautic are affected by CVE-2024-47059?
CVE-2024-47059 affects Mautic core versions between 5.1.0 and 5.1.1 inclusive.
- agent/remedy
- agent/type
- agent/title
- agent/first-publish-date
- agent/weakness
- agent/description
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8vff-35qm-qjvv
- alias/CVE-2024-47059
- agent/software-canonical-lookup
- agent/severity
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- agent/author
- agent/trending
- agent/source
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- package-manager/composer
- vendor/acquia
- canonical/mautic
- version/mautic/5.1.0