What is CVE-2017-1000490?

CVE-2017-1000490 is a medium-severity vulnerability in Acquia Mautic, classified under Path Traversal. CVSS score: 6.5/10. Published 2018-01-03.

How severe is CVE-2017-1000490?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Path Traversal in Acquia Mautic

CVE-2017-1000490

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Acquia Mautic — versions 1.0.1, 1.0.2, 1.0.3
Mautic — versions 1.0.0, 1.2.0, 2.9.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (x_refsource_CONFIRM, Exploit, Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2017-1000490?: CVE-2017-1000490 is a medium-severity vulnerability in Acquia Mautic, classified under Path Traversal. CVSS score: 6.5/10. Published 2018-01-03.
How severe is CVE-2017-1000490?: Medium severity. CVSS v3 base score is 6.5 out of 10.