VDB
Sign up
CRITICAL

GHSA-3fq7-c5m8-g86x

Mautic user without privileged access to the Marketplace can install and uninstall composer packages

Quick fix

GHSA-3fq7-c5m8-g86x — mautic/core: upgrade to the fixed version with the command below.

composer require mautic/core:^4.4.18

Details

### Summary

A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

### Impact

A low-privileged user of the platform can install malicious code to obtain higher privileges.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mautic/core
Introduced in: 4.0.0Fixed in: 4.4.18
Fixcomposer require mautic/core:^4.4.18
Packagist/mautic/core
Introduced in: 5.0.0Fixed in: 5.2.9
Fixcomposer require mautic/core:^5.2.9
Packagist/mautic/core
Introduced in: 6.0.0Fixed in: 6.0.7
Fixcomposer require mautic/core:^6.0.7

References