CVE-2018-10189
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.
- Score
- CVSS 3.0 7.5 High
- Status
- Modified - cve@mitre.org
- Published
- 2018-04-17
- Last modified
- 2024-09-17
- Weaknesses
- CWE-200
Affected products
References
- https://github.com/mautic/mautic/releases/tag/2.13.0
