Lucene search

MitreCVE-2017-1000490

HistoryJan 03, 2018 - 5:29 p.m.

CVE-2017-1000490

2018-01-0317:29:00

CWE-22

mitre

web.nvd.nist.gov

mautic

filemanager

server vulnerability

cve-2017-1000490

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

26.3%

JSON

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Affected configurations

Nvd

Node

acquiamauticMatch1.0.1

acquiamauticMatch1.0.2

acquiamauticMatch1.0.3

acquiamauticMatch1.0.4

acquiamauticMatch1.0.5

acquiamauticMatch1.1.0

acquiamauticMatch1.1.1

acquiamauticMatch1.1.2

acquiamauticMatch1.1.3

acquiamauticMatch1.2.0beta1

acquiamauticMatch1.2.1

acquiamauticMatch1.2.2

acquiamauticMatch1.2.3

acquiamauticMatch1.2.4

acquiamauticMatch1.3.0

acquiamauticMatch1.3.1

acquiamauticMatch1.4.0

acquiamauticMatch1.4.1

acquiamauticMatch2.0.0

acquiamauticMatch2.0.1

acquiamauticMatch2.1.0

acquiamauticMatch2.1.1

acquiamauticMatch2.2.0

acquiamauticMatch2.2.1

acquiamauticMatch2.3.0

acquiamauticMatch2.4.0

acquiamauticMatch2.5.0

acquiamauticMatch2.5.1

acquiamauticMatch2.6.0

acquiamauticMatch2.6.1

acquiamauticMatch2.7.0

acquiamauticMatch2.7.1

acquiamauticMatch2.8.0

acquiamauticMatch2.8.1

acquiamauticMatch2.8.2

acquiamauticMatch2.9.0beta

acquiamauticMatch2.9.1

acquiamauticMatch2.10.0beta

acquiamauticMatch2.10.1

acquiamauticMatch2.11.0beta

mauticmauticMatch1.0.0

mauticmauticMatch1.2.0

mauticmauticMatch2.9.0

mauticmauticMatch2.9.2

mauticmauticMatch2.10.0

mauticmauticMatch2.11.0

VendorProductVersionCPE
acquiamautic1.0.1cpe:2.3:a:acquia:mautic:1.0.1:*:*:*:*:*:*:*
acquiamautic1.0.2cpe:2.3:a:acquia:mautic:1.0.2:*:*:*:*:*:*:*
acquiamautic1.0.3cpe:2.3:a:acquia:mautic:1.0.3:*:*:*:*:*:*:*
acquiamautic1.0.4cpe:2.3:a:acquia:mautic:1.0.4:*:*:*:*:*:*:*
acquiamautic1.0.5cpe:2.3:a:acquia:mautic:1.0.5:*:*:*:*:*:*:*
acquiamautic1.1.0cpe:2.3:a:acquia:mautic:1.1.0:*:*:*:*:*:*:*
acquiamautic1.1.1cpe:2.3:a:acquia:mautic:1.1.1:*:*:*:*:*:*:*
acquiamautic1.1.2cpe:2.3:a:acquia:mautic:1.1.2:*:*:*:*:*:*:*
acquiamautic1.1.3cpe:2.3:a:acquia:mautic:1.1.3:*:*:*:*:*:*:*
acquiamautic1.2.0cpe:2.3:a:acquia:mautic:1.2.0:beta1:*:*:*:*:*:*

Vendor	Product	Version	CPE
acquia	mautic	1.0.1	cpe:2.3:a:acquia:mautic:1.0.1:::::::*
acquia	mautic	1.0.2	cpe:2.3:a:acquia:mautic:1.0.2:::::::*
acquia	mautic	1.0.3	cpe:2.3:a:acquia:mautic:1.0.3:::::::*
acquia	mautic	1.0.4	cpe:2.3:a:acquia:mautic:1.0.4:::::::*
acquia	mautic	1.0.5	cpe:2.3:a:acquia:mautic:1.0.5:::::::*
acquia	mautic	1.1.0	cpe:2.3:a:acquia:mautic:1.1.0:::::::*
acquia	mautic	1.1.1	cpe:2.3:a:acquia:mautic:1.1.1:::::::*
acquia	mautic	1.1.2	cpe:2.3:a:acquia:mautic:1.1.2:::::::*
acquia	mautic	1.1.3	cpe:2.3:a:acquia:mautic:1.1.3:::::::*
acquia	mautic	1.2.0	cpe:2.3:a:acquia:mautic:1.2.0:beta1::::::

Rows per page:

1-10 of 461

References

github.com/mautic/mautic/releases/tag/2.12.0

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

26.3%

JSON

Related for CVE-2017-1000490