« Volver al listado

CVE-2025-5257

Estado: AplazadaMedia (6.5)—

SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information.

Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/preview/2), lacked proper authorization checks.

Leer descripción completaMostrar menos

This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable. MitigationMautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mautic — MauticAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-5257",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5257",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-28T23:41:33.783649Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@mautic.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@mautic.org",
      "affectedData": [
        {
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "product": "Mautic",
          "versions": [
            {
              "status": "affected",
              "version": "> 4.0",
              "lessThan": "< 6.0.2, <5.4.6, <4.4.16",
              "versionType": "semver"
            }
          ],
          "packageName": "mautic/core",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-28T17:15:25.917",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-cqx4-9vqf-q3m8",
      "source": "security@mautic.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@mautic.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information.\n\nUnauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/preview/2), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable.\nMitigationMautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later."
    },
    {
      "lang": "es",
      "value": "Resumen: Este aviso aborda una vulnerabilidad de seguridad en Mautic que permitía a usuarios no autenticados acceder a vistas previas de páginas no publicadas, las cuales podrían ser indexadas por motores de búsqueda. Esto podría provocar la divulgación involuntaria de borradores o información confidencial. Acceso no autorizado a vistas previas de páginas no publicadas: La función de vista previa de páginas para contenido no publicado, accesible mediante URL predecibles (p. ej., /page/preview/1, /page/preview/2), carecía de las comprobaciones de autorización adecuadas. Esto permitía a cualquier usuario no autenticado ver contenido que aún no estaba destinado a ser publicado, y permitía a los motores de búsqueda indexar estas URL de vista previa privadas, haciendo que el contenido fuera visible públicamente. Mitigación: Mautic ha corregido esta vulnerabilidad implementando las comprobaciones de permisos adecuadas en las páginas de vista previa. Los usuarios deben actualizar a la versión corregida de Mautic o una versión posterior."
    }
  ],
  "lastModified": "2026-06-17T09:47:33.567",
  "sourceIdentifier": "security@mautic.org"
}