GHSA-vfxj-qg93-7wwc
Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
Quick fix
GHSA-vfxj-qg93-7wwc — mautic/core: upgrade to the fixed version with the command below.
composer require mautic/core:^2.13.0Details
### Impact An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.
### Patches Update to 2.13.0 or later
### Workarounds None
### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)
Are you affected?
Enter the version of the package you're using.