Improper Access Control Leads to Server-Side Request Forgery in Mautic
Vulnerability Description
Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3448
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- ZHAW Information Security Research Group
More from Mautic
View All →Affected Vendor
Mautic
View all reports →