CVE-2021-27908

{"containers": {"cna": {"affected": [{"product": "Mautic", "vendor": "Mautic", "versions": [{"lessThan": "3.3.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Discovered by Petr Gregor, Acquia"}, {"lang": "en", "value": "Fixed by Miroslav Fedeles, Acquia"}], "datePublic": "2021-03-22T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic\u2019s configuration that are used in publicly facing parts of the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-23T19:11:56.000Z", "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mautic.org", "DATE_PUBLIC": "2021-03-22T20:15:00.000Z", "ID": "CVE-2021-27908", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Mautic", "version": {"version_data": [{"version_affected": "<", "version_value": "3.3.2"}]}}]}, "vendor_name": "Mautic"}]}}, "credit": [{"lang": "eng", "value": "Discovered by Petr Gregor, Acquia"}, {"lang": "eng", "value": "Fixed by Miroslav Fedeles, Acquia"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic\u2019s configuration that are used in publicly facing parts of the application."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200 Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx", "refsource": "MISC", "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:33:16.928Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx"}]}]}, "cveMetadata": {"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "assignerShortName": "Mautic", "cveId": "CVE-2021-27908", "datePublished": "2021-03-23T19:11:56.967Z", "dateReserved": "2021-03-02T00:00:00.000Z", "dateUpdated": "2024-09-16T16:23:48.079Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Mautic", "vendor": "Mautic", "versions": [{"lessThan": "3.3.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@mautic.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8C98868-2DB4-48C5-8238-3AA1FA7B936B", "versionEndExcluding": "3.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic\u2019s configuration that are used in publicly facing parts of the application."}, {"lang": "es", "value": "En todas las versiones anteriores a Mautic 3.3.2, par\u00e1metros secretos, como las credenciales de la base de datos, pod\u00edan ser expuestos p\u00fablicamente por un usuario administrador autorizado aprovechando la sintaxis de los par\u00e1metros Symfony en cualquiera de los campos de texto libre en la configuraci\u00f3n de Mautic que son usadas en las partes de la aplicaci\u00f3n de cara al p\u00fablico"}], "id": "CVE-2021-27908", "lastModified": "2026-06-17T03:45:35.787", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 5.5, "source": "security@mautic.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-23T20:15:13.310", "references": [{"source": "security@mautic.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx"}], "sourceIdentifier": "security@mautic.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@mautic.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}