Drupal Acquia DAM allows Forceful Browsing

Summary This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

Mitigation

Please update to 5.2.10, 6.0.8, 7.0.1 or later.

Workarounds

None.

References

If there are any questions or comments about this advisory:

Email Mautic at security@mautic.org

Impact With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.

Patches Upgrade to 4.4.13 or 5.1.1 or later.

Workarounds None

References - https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) - https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Summary

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.

Patches

Update to 5.1.1 or later.

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Summary Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Patches Please update to 4.4.13 or 5.1.1 or later.

Workarounds None

References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting

If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact

Mautic allows you to update the application via an upgrade script.

The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.

This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable

Patches

Please upgrade to 4.4.1 or 5.1.1 or later.

Workarounds None.

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Summary

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.

Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.

Mitigation

Please update to Mautic 5.2.3 or later

Workarounds

Disable the API in Mautic. See documentation.

References https://cwe.mitre.org/data/definitions/285.html https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Summary This advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.

Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

Mitigation Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.

Workarounds None

If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic.

Users could inject malicious code into the notification when saving Dashboards.

Patches Update to Mautic 4.4.12.

Workarounds None

References - https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS)

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Impact Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.

The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.

Patches Update to 4.4.12 or 5.0.4

Workarounds No

References - https://owasp.org/www-community/attacks/SQLInjection - https://owasp.org/www-community/attacks/BlindSQLInjection

Impact Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.

Users could potentially access sensitive data such as names and surnames, company names and stage names.

Patches Update to 4.4.12 and 5.0.4

Workarounds No

References https://owasp.org/www-project-top-ten/2017/A32017-SensitiveDataExposure

Impact Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.

Patches Update to 4.4.12 or 5.0.4

Workarounds None

References - https://owasp.org/Top10/A102021-Server-SideRequestForgery%28SSRF%29/

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Summary

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

Mitigation

Please update to 5.2.3 or later.

Workarounds

None

References

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Impact

Mautic allows you to track open rates by using tracking pixels. The tracking information is stored together with extra metadata of the tracking request.

The output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation.

Patches

Please upgrade to 4.3.0

Workarounds None.

References Internally tracked under MST-38

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Patches Upgrade to 4.4.13 or 5.1.1 or later.

Workarounds None.

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qf6m-6m4g-rmrc. This link is maintained to preserve external references.

Original Description Mautic allows you to update the application via an upgrade script.

The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.

This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

Impact Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions.

This could lead to the user having elevated access to the system.

Patches Update to 4.4.12

Workarounds None

References - https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) - https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Impact Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files.

This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

Patches Update to 4.4.12 or 5.0.4.

Workarounds No

References - https://cwe.mitre.org/data/definitions/23.html - https://cwe.mitre.org/data/definitions/22.html - https://attack.mitre.org/techniques/T1630/002/

For more information

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Summary Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Patches Please update to 4.4.13 or 5.1.1 or later.

Workarounds None

References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting

If you have any questions or comments about this advisory:

Email us at security@mautic.org

Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.

Impact Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

Patches Update to 2.14.0 or later.

Workarounds None.

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

Patches Update to 2.14 or later

Workarounds None

References https://github.com/mautic/mautic/releases/tag/2.14.0

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Mautic Cross-Site Request Forgery (CSRF)

Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Patches Update to 2.12.0 or later.

Workarounds None

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

Patches Upgrade to 2.12.0 or later.

Workarounds None.

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

Patches Upgrade to 2.12.0 or later.

Workarounds None

References https://github.com/mautic/mautic/releases/tag/2.12.0

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

Impact the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

Patches Please upgrade to 3.3.5 or 4.2.0

Workarounds No

References

- Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic - Internally tracked under MST-32

For more information If you have any questions or comments about this advisory: Email us at security@mautic.org

The commonsdiscussionviewsdefaultviews function in modules/features/commonsdiscussion/commonsdiscussion.viewsdefault.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing.