Detections
Analytics

SCA: security update for mautic/core (GHSA-vph5-ghq3-q782)

medium Tenable Cloud Security Plugin ID 434798

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning
 functionality. This vulnerability allows any authenticated user to clone segments without proper
 authorization checks. Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing
 authorization vulnerability exists in the cloneAction of the segment management. This allows an
 authenticated user to bypass intended permission restrictions and clone segments even if they lack the
 necessary permissions to create new ones. MitigationUpdate Mautic to a version that implements proper
 authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to
 clone segments possess the appropriate creation permissions. (CVE-2024-47055)

See Also

https://github.com/advisories/GHSA-vph5-ghq3-q782

Plugin Details

Severity: Medium

ID: 434798

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 8/20/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2024-47055

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2025

Vulnerability Publication Date: 5/28/2025

Reference Information

CVE: CVE-2024-47055