CVE-2024-47059

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:acquia:mautic:5.1.0:*:*:*:*:*:*:*

History

27 Feb 2025, 19:30

Type	Values Removed	Values Added
References	~~() https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv -~~	() https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv - Vendor Advisory
CWE		NVD-CWE-Other
First Time		Acquia mautic Acquia
CPE		cpe:2.3:a:acquia:mautic:5.1.0:::::::*

19 Sep 2024, 20:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~0.0~~	v2 : unknown v3 : 4.3
Summary		(es) Al iniciar sesión con el nombre de usuario correcto y una contraseña débil incorrecta, el usuario recibe una notificación que indica que su contraseña es demasiado débil. Sin embargo, cuando se proporciona un nombre de usuario incorrecto junto con una contraseña débil, la aplicación responde con una notificación de "Credenciales no válidas". Esta diferencia se puede utilizar para realizar la enumeración de nombres de usuario.

18 Sep 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-18 22:15

Updated : 2025-02-27 19:30

NVD link : CVE-2024-47059

Mitre link : CVE-2024-47059

CVE.ORG link : CVE-2024-47059

JSON object : View

Products Affected

acquia

mautic

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-Other

{"id": "CVE-2024-47059", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@mautic.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-18T22:15:04.650", "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv", "tags": ["Vendor Advisory"], "source": "security@mautic.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@mautic.org", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided alongside with a weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration."}, {"lang": "es", "value": "Al iniciar sesi\u00f3n con el nombre de usuario correcto y una contrase\u00f1a d\u00e9bil incorrecta, el usuario recibe una notificaci\u00f3n que indica que su contrase\u00f1a es demasiado d\u00e9bil. Sin embargo, cuando se proporciona un nombre de usuario incorrecto junto con una contrase\u00f1a d\u00e9bil, la aplicaci\u00f3n responde con una notificaci\u00f3n de \"Credenciales no v\u00e1lidas\". Esta diferencia se puede utilizar para realizar la enumeraci\u00f3n de nombres de usuario."}], "lastModified": "2025-02-27T19:30:33.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:acquia:mautic:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "218C24B5-AAED-49DE-BD4D-DA7B37D55744"}], "operator": "OR"}]}], "sourceIdentifier": "security@mautic.org"}