Miggo Logo
Miggo Vulnerability Database
→
GHSA-5hc5-fxr9-5frc

GHSA-5hc5-fxr9-5frc: Duplicate Advisory: Mautic has insufficient authentication in upgrade flow

7.8

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-5hc5-fxr9-5frc
EPSS Score
-
CWE
CWE-306
Published
9/19/2024
Updated
2/21/2025
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
mautic/corecomposer>= 1.0.0-beta3, < 4.4.134.4.13
mautic/corecomposer>= 5.0.0, < 5.1.15.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers on insufficient authentication in upgrade mechanisms. While exact code isn't available, Mautic's architecture suggests:

  1. Web-accessible upgrade controllers would handle update initiation
  2. CLI commands might be improperly exposed via web routes
  3. The CWE-306 classification indicates missing auth checks in critical update functions
  4. Version ranges suggest both legacy (4.x) and modern (5.x) implementations had similar flaws Confidence is medium as we're inferring based on component structure and vulnerability pattern, though without direct access to pre-patch code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* **S*-q**m-*m**-rmr*. T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. # Ori*in*l **s*ription M*uti* *llows you to up**t* t** *ppli**tion vi* *n up*r*** s*ript

Reasoning

T** vuln*r**ility **nt*rs on insu**i*i*nt *ut**nti**tion in up*r*** m****nisms. W*il* *x**t *o** isn't *v*il**l*, M*uti*'s *r**it**tur* su***sts: *. W**-****ssi*l* up*r*** *ontroll*rs woul* **n*l* up**t* initi*tion *. *LI *omm*n*s mi**t ** improp*rly