CVE-2024-2730

Published: Apr 10, 2024Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: vulnerability@ncsc.ch (Secondary)

Description

Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data. At the time of publication of the CVE no patch is available

Related CWEs

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (2)

https://huntr.com/bounties/cd3321a4-9ebc-48fa-8d4c-b5720089c2d9

Source: vulnerability@ncsc.ch

https://huntr.com/bounties/cd3321a4-9ebc-48fa-8d4c-b5720089c2d9

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.