GHSA-6x98-fx9j-7c78HighCVSS 8.1

Disabled users able to log in with third party SSO plugin

Published
January 19, 2021
Last Modified
September 11, 2023

🔗 CVE IDs covered (1)

CVE-2017-1000489 →

📋 Description

Impact

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

Patches

Upgrade to 2.12.0 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • composer/mautic/core:>= 2.0.0, < 2.12.0

🔗 References (5)