CVE-2024-47051

Katalog CVE

CVSS 9.9 · Critical EPSS 1,8%

Kerentanan Relative Path Traversal pada acquia mautic. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts. * Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.

Rincian

Terbit di NVD

26 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2 advisory vendor
• https://owasp.org/www-community/attacks/Code_Injection not applicable
• https://owasp.org/www-community/attacks/Path_Traversal not applicable