CVE-2024-47053
Published: 26 February 2025
Summary
CVE-2024-47053 is a high-severity Improper Authorization (CWE-285) vulnerability in Acquia Mautic. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-47053 is an improper authorization vulnerability (CWE-285) in Mautic's API authorization implementation, specifically tied to its HTTP Basic Authentication. The flaw affects Mautic, an open-source marketing automation platform, where any authenticated user can bypass intended access controls to retrieve all reports and associated sensitive data via the API. This circumvents role-based permissions such as "Reporting Permissions > View Own" and "Reporting Permissions > View Others," which are designed to restrict access to non-System Reports. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), rated as high severity due to its network accessibility and confidentiality impact.
Any low-privileged authenticated user can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation involves crafting API requests to access restricted reports, granting unauthorized visibility into sensitive data regardless of the user's assigned roles or permissions. This enables potential data exfiltration of reports containing confidential information, such as customer insights or marketing analytics, without altering or disrupting the system.
For mitigation details, refer to the official Mautic GitHub security advisory at GHSA-8xv7-g2q3-fqgc, which addresses the issue, along with Mautic's API settings documentation at docs.mautic.org/en/5.2/configuration/settings.html#api-settings. The advisory was published on 2025-02-26.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5295
Vulnerability details
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned…
more
roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization in authenticated API allows valid low-priv accounts to bypass RBAC and directly access restricted reports/data repositories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for logical access in accordance with access control policies, directly addressing the API's failure to enforce role-based permissions like 'View Own' and 'View Others' for report data.
AC-6 employs least privilege to restrict users to only necessary accesses, mitigating unauthorized access to restricted reports by low-privileged authenticated users.
AC-24 requires explicit authorization decisions prior to enforcement, countering the flawed API authorization logic that bypassed permission checks.