Medium severity · published Sep 18, 2024
CVE-2024-47059
Users enumeration - weak password login
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mautic · Mautic
>= 5.1.0 before < 5.1.1 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47059
Vendor Advisory
https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv
More from Mautic
9.8
CVE-2018-8092
Mautic before 2.13.0 allows CSV injection
9.1
CVE-2022-25769
Improper regex in htaccess file
9.0
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
9.0
CVE-2021-27915
XSS Cross-site Scripting Stored (XSS) - Description field
9.0
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS