CVE-2025-7381

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7381", "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "state": "PUBLISHED", "assignerShortName": "Mautic", "dateReserved": "2025-07-09T08:22:14.606Z", "datePublished": "2025-07-09T15:16:37.305Z", "dateUpdated": "2025-07-10T07:43:06.651Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected", "packageName": "mautic/mautic", "product": "Docker Mautic", "repo": "https://github.com/mautic/docker-mautic", "vendor": "mautic", "versions": [{"status": "affected", "version": "<= 6.0.3-20250707-apache", "versionType": "custom"}, {"status": "affected", "version": "<= 6.0.3-20250707-fpm", "versionType": "custom"}, {"status": "affected", "version": "<= 5.2.7-20250707-apache", "versionType": "custom"}, {"status": "affected", "version": "<= 5.2.7-20250707-fpm", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "cibero42"}, {"lang": "en", "type": "remediation developer", "value": "cibero42"}, {"lang": "en", "type": "reporter", "value": "cibero42"}], "datePublic": "2025-07-09T13:37:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<h3>Impact</h3><p>This is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.</p><h3>Workarounds</h3><p>The mitigation requires changing the <code>expose_php</code>&nbsp;variable from \"On\" to \"Off\" in the file located at <code>/usr/local/etc/php/php.ini</code>.</p><br>"}], "value": "ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.\n\nWorkaroundsThe mitigation requires changing the expose_php\u00a0variable from \"On\" to \"Off\" in the file located at /usr/local/etc/php/php.ini."}], "impacts": [{"capecId": "CAPEC-170", "descriptions": [{"lang": "en", "value": "CAPEC-170 Web Application Fingerprinting"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic", "dateUpdated": "2025-07-10T07:43:06.651Z"}, "references": [{"url": "https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx"}], "source": {"advisory": "GHSA-vr8r-c5qv-4w2r", "discovery": "INTERNAL"}, "title": "Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The mitigation requires changing the <code>expose_php</code>&nbsp;variable from \"On\" to \"Off\" in the file located at <code>/usr/local/etc/php/php.ini</code>.</p>"}], "value": "The mitigation requires changing the expose_php\u00a0variable from \"On\" to \"Off\" in the file located at /usr/local/etc/php/php.ini."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-09T15:56:53.545310Z", "id": "CVE-2025-7381", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T15:56:59.162Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7381", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-09T15:56:53.545310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T15:56:55.772Z"}}], "cna": {"title": "Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "cibero42"}, {"lang": "en", "type": "remediation developer", "value": "cibero42"}, {"lang": "en", "type": "reporter", "value": "cibero42"}], "impacts": [{"capecId": "CAPEC-170", "descriptions": [{"lang": "en", "value": "CAPEC-170 Web Application Fingerprinting"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/mautic/docker-mautic", "vendor": "mautic", "product": "Docker Mautic", "versions": [{"status": "affected", "version": "< 6.0.3-20250707-apache", "versionType": "custom"}, {"status": "affected", "version": "< 6.0.3-20250707-fpm", "versionType": "custom"}], "packageName": "mautic/mautic", "collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected"}], "datePublic": "2025-07-09T13:37:00.000Z", "references": [{"url": "https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx"}], "workarounds": [{"lang": "en", "value": "The mitigation requires changing the expose_php\u00a0variable from \"On\" to \"Off\" in the file located at /usr/local/etc/php/php.ini.", "supportingMedia": [{"type": "text/html", "value": "<p>The mitigation requires changing the <code>expose_php</code>&nbsp;variable from \"On\" to \"Off\" in the file located at <code>/usr/local/etc/php/php.ini</code>.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.\n\nWorkaroundsThe mitigation requires changing the expose_php\u00a0variable from \"On\" to \"Off\" in the file located at /usr/local/etc/php/php.ini.", "supportingMedia": [{"type": "text/html", "value": "<h3>Impact</h3><p>This is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.</p><h3>Workarounds</h3><p>The mitigation requires changing the <code>expose_php</code>&nbsp;variable from \"On\" to \"Off\" in the file located at <code>/usr/local/etc/php/php.ini</code>.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497"}]}], "providerMetadata": {"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic", "dateUpdated": "2025-07-09T15:16:37.305Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7381", "state": "PUBLISHED", "dateUpdated": "2025-07-09T15:56:59.162Z", "dateReserved": "2025-07-09T08:22:14.606Z", "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "datePublished": "2025-07-09T15:16:37.305Z", "assignerShortName": "Mautic"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"collectionURL": "https://hub.docker.com", "defaultStatus": "unaffected", "packageName": "mautic/mautic", "product": "Docker Mautic", "repo": "https://github.com/mautic/docker-mautic", "vendor": "mautic", "versions": [{"status": "affected", "version": "<= 6.0.3-20250707-apache", "versionType": "custom"}, {"status": "affected", "version": "<= 6.0.3-20250707-fpm", "versionType": "custom"}, {"status": "affected", "version": "<= 5.2.7-20250707-apache", "versionType": "custom"}, {"status": "affected", "version": "<= 5.2.7-20250707-fpm", "versionType": "custom"}]}], "source": "security@mautic.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.\n\nWorkaroundsThe mitigation requires changing the expose_php\u00a0variable from \"On\" to \"Off\" in the file located at /usr/local/etc/php/php.ini."}, {"lang": "es", "value": "ImpactThis es una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n que se origina en la imagen base de PHP. Esta vulnerabilidad expone la versi\u00f3n de PHP mediante un encabezado X-Powered-By, que los atacantes podr\u00edan explotar para identificar el servidor e identificar posibles vulnerabilidades. Soluciones alternativas: La mitigaci\u00f3n requiere cambiar la variable expose_php de \"On\" a \"Off\" en el archivo ubicado en /usr/local/etc/php/php.ini."}], "id": "CVE-2025-7381", "lastModified": "2026-06-17T10:04:48.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@mautic.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7381", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-09T15:56:53.545310Z", "version": "2.0.3"}}]}, "published": "2025-07-09T16:15:27.890", "references": [{"source": "security@mautic.org", "url": "https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx"}], "sourceIdentifier": "security@mautic.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "security@mautic.org", "type": "Secondary"}]}

{}

{"created": "2025-07-13T22:31:23.879273+00:00", "updated": "2025-07-13T22:31:23.879327+00:00", "vendors": ["mautic", "mautic$PRODUCT$mautic"]}