CVE-2018-10189 - CVE House
Back to Database
Status published High CVE-2018-10189

An issue was discovered in Mautic 1.x and 2.x before...

Vulnerability Description

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10189

Credits & Attribution

No credits recorded in the NVD database.

References

More from mautic

View All →
CVE-2025-7381
Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images
Medium 5.3
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker...
Critical 9
CVE-2018-8092
Mautic before 2.13.0 allows CSV injection....
Critical 9.8
CVE-2018-8071
Mautic before v2.13.0 has stored XSS via a theme config...
Medium 6.1
CVE-2017-1000506
Mautic version 2.11.0 and earlier contains a Cross Site Scripting...
Medium 6.1

Affected Vendor

Affected Software

mautic
Vulnerable Versions:
1.0.0, 2.0.0

Timeline

Official Publish: April 17th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.