CVE-2017-1000490

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mautic/mautic/releases/tag/2.12.0Exploit, Release Notes, Third Party Advisory
https://github.com/mautic/mautic/releases/tag/2.12.0Exploit, Release Notes, Third Party Advisory

Timeline

Published: Jan 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10004916.1Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.CVE-2017-10004926.1Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration CVE-2017-10004939.8Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover CVE-2017-10004947.8Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial CVE-2017-10004955.4QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and pe CVE-2017-10004968.8Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remo CVE-2017-10004979.8Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote cod CVE-2017-10004987.8AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code e CVE-2017-10004998.8phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is p CVE-2017-100056.1Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supp CVE-2017-10005019.8Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in CVE-2017-10005028.8Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands