Vulnerability Assessment
| Impact | CVSS score of 7.5 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.28%. |
| Exploit ScenarioDerived | This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Mautic 2.6.1 and earlier fails to set flags on session cookies. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mautic 2.6.1 and earlier fails to set flags on session cookies Affected products include: Mautic.
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Mautic 2.6.1 and earlier fails to set flags on session cookies
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerab
Remote code execution can result in Mautic 7 (7.0.0 through 7.2.1) when campaign-import archives carry asset files that
Mautic before 2.13.0 allows CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. Rated critical se
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authenti
Server-side template injection in Mautic's Twig theme sandbox lets an authenticated user holding the core:themes:create
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an au
Stored cross-site scripting in Mautic 7.0.0 through 7.2.1 allows anyone who can write a value into an HTML-type custom c
PHP object injection in Mautic's segment filters and custom field properties can escalate to server-side code execution
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. Rated high
Mautic's Contact Activity API endpoint is vulnerable to SQL injection due to insufficient validation of the sort directi
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature bei
GitHub PoC
Exploit-DB