CVE-2017-1000490
Mautic users able to download any files from server using filemanager
6.5
MEDIUM
CVSS 3.1
EPSS 0.34%
Description
### Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to. ### Patches Update to 2.12.0 or later. ### Workarounds None ### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)
How to fix CVE-2017-1000490
To remediate CVE-2017-1000490, upgrade the affected package to a fixed version below.
- —upgrade to 2.12.0 or later
Is CVE-2017-1000490 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.0.0, < 2.12.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |