CVE-2021-27908
published 2021-03-23CVE-2021-27908: In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging…
PriorityP419medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.34%
26.4th percentile
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| acquia | mautic | < 3.3.2 | 3.3.2 |
| mautic | core | >= 0 < 3.3.2 | 3.3.2 |
| mautic | mautic | >= unspecified < 3.3.2 | 3.3.2 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mautic vulnerable to secret data exfiltration via symfony parameters
osv·2021-04-06
CVE-2021-27908 [MEDIUM] Mautic vulnerable to secret data exfiltration via symfony parameters
Mautic vulnerable to secret data exfiltration via symfony parameters
### Impact
Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.
For example,
1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: console.log("db password is: %mautic.db_password%"); `
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: `db password is: `
Risk rating: Mode
GHSA
Mautic vulnerable to secret data exfiltration via symfony parameters
ghsa·2021-04-06
CVE-2021-27908 [MEDIUM] CWE-732 Mautic vulnerable to secret data exfiltration via symfony parameters
Mautic vulnerable to secret data exfiltration via symfony parameters
### Impact
Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.
For example,
1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: console.log("db password is: %mautic.db_password%"); `
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: `db password is: `
Risk rating: Mode
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-23
Published