Information Exposure Affecting mautic/core package, versions <3.3.2
Snyk CVSS
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Confidentiality
High
Integrity
High
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-MAUTICCORE-1088511
- published 24 Mar 2021
- disclosed 24 Mar 2021
- credit Petr Gregor, Miroslav Fedeleš
Introduced: 24 Mar 2021
CVE-2021-27908 Open this link in a new tabHow to fix?
Upgrade mautic/core to version 3.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure. Secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.