CVE-2024-47059
published 2024-09-18CVE-2024-47059: When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.34%
25.9th percentile
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| acquia | mautic | — | — |
| mautic | core | >= 5.1.0 < 5.1.1 | 5.1.1 |
| mautic | mautic | >= >= 5.1.0 < < 5.1.1 | < 5.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mautic allows users enumeration due to weak password login
ghsa·2024-09-18
CVE-2024-47059 [MEDIUM] CWE-200 Mautic allows users enumeration due to weak password login
Mautic allows users enumeration due to weak password login
### Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
### Patches
Update to 5.1.1 or later.
If you have any questions or comments about this advisory:
Email us at [[email protected]](mailto:[email protected])
OSV
Mautic allows users enumeration due to weak password login
osv·2024-09-18
CVE-2024-47059 [MEDIUM] Mautic allows users enumeration due to weak password login
Mautic allows users enumeration due to weak password login
### Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
### Patches
Update to 5.1.1 or later.
If you have any questions or comments about this advisory:
Email us at [[email protected]](mailto:[email protected])
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-18
Published