CVE-2017-1000489

HIGH8.1EPSS 0.27%

Disabled users able to log in with third party SSO plugin

Published: 1/19/2021Modified: 2/16/2024

Description

### Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address ### Patches Upgrade to 2.12.0 or later. ### Workarounds None. ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

Affected packages (1)

Packagist/mautic/core>= 2.0.0, < 2.12.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-1000489
WEBhttps://github.com/mautic/mautic/commit/fd933cbef795b04cabdc50527cb18e037488fef9
WEBhttps://github.com/mautic/mautic/releases/tag/2.12.0
WEBhttps://github.com/mautic/mautic/security/advisories/GHSA-6x98-fx9j-7c78