CVE-2025-9824
BaseFortify
Publication date: 2025-09-03
Last updated on: 2025-09-04
Assigner: Mautic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mautic | mautic | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a user enumeration issue caused by timing differences in login responses. When a valid username is submitted, the system performs password hashing, which takes longer, whereas for invalid usernames, no hashing occurs, resulting in faster responses. Attackers can measure these timing differences to confirm whether a username exists, enabling them to enumerate valid users and potentially launch brute force attacks. [1]
How can this vulnerability impact me? :
The vulnerability allows attackers to determine valid usernames by analyzing response times during login attempts. Once valid usernames are identified, attackers can attempt brute force attacks to compromise accounts. This can lead to denial of service or unauthorized access attempts, impacting system availability and security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by measuring the response times of login attempts with different usernames. Specifically, an attacker can send login requests with various usernames and observe timing differences: valid usernames cause longer response times due to password hashing, while invalid usernames respond faster. To detect this on your system, you can use tools like curl or automated scripts to send login requests and measure response times. For example, using curl with time measurement: curl -w "%{time_total}\n" -o /dev/null -s -X POST -d 'username=someuser&password=somepass' https://your-login-url. Repeating this with different usernames and comparing response times can reveal timing discrepancies indicative of the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade your Mautic installation to a patched version that includes the TimingSafeFormLoginAuthenticator fix. Specifically, upgrade to versions 4.4.17, 5.2.8, or 6.0.5 or later. There are no workarounds available, so applying the official patch is necessary to ensure consistent response times and prevent username enumeration via timing attacks. [1]