Detections
Analytics

SCA: security update for mautic/core (GHSA-8xv7-g2q3-fqgc)

high Tenable Cloud Security Plugin ID 421001

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication
 implementation. This flaw could allow unauthorized access to sensitive report data. * Improper
 Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any
 authenticated user, regardless of assigned roles or permissions, can access all reports and their
 associated data via the API. This bypasses the intended access controls governed by the "Reporting
 Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict
 access to non-System Reports. (CVE-2024-47053)

See Also

https://github.com/advisories/GHSA-8xv7-g2q3-fqgc

Plugin Details

Severity: High

ID: 421001

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 2/27/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.16

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2024-47053

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/26/2025

Vulnerability Publication Date: 2/26/2025

Reference Information

CVE: CVE-2024-47053