User Enumeration Vulnerability in Mautic Password Reset Functionality
CVE-2024-47057

5.3MEDIUM

Key Information:

Vendor

Mautic

Status
Mautic
Vendor
CVE Published:
28 May 2025

What is CVE-2024-47057?

This security vulnerability in Mautic's 'Forget your password' function allows unauthenticated users to exploit timing discrepancies, leading to the enumeration of valid usernames. The lack of request limiting and varying response times for existing and non-existing users enables attackers to determine which usernames are valid through observation of response latency. To mitigate this risk, it is crucial to update to a patched version that normalizes response times for all password reset requests.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mautic > 1.0

References

https://github.com/mautic/mautic/security/advisories/GHSA...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tomasz Kowalczyk
Patryk Gruszka
Nick Vanpraet
Tomasz Kowalczyk
JSON
.