Medium severity · published Apr 10, 2024
CVE-2024-2730
Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data. At the time of publication of the CVE no patch is available
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mautic · Mautic
through 4.4.9 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2730
huntr.com
https://huntr.com/bounties/cd3321a4-9ebc-48fa-8d4c-b5720089c2d9
More from Mautic
9.8
CVE-2018-8092
Mautic before 2.13.0 allows CSV injection
9.1
CVE-2022-25769
Improper regex in htaccess file
9.0
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
9.0
CVE-2021-27915
XSS Cross-site Scripting Stored (XSS) - Description field
9.0
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS