Mautic: Arbitary server file download

[ranjit-git]

Masked for security. Please send all security vulnerabilities to [email protected]. Patch coming soon. ~ Contributors

[micschk]

@alanhartless I've found this security address here, couldn't find anything on the websites about Responsible Disclosure. Would be good to add a page for that and link to it in the footer.

[micschk]

@pahan12 How serious is this security issue? Should this be a reason to (temporarily) deactivate Mautic until resolved?

[ranjit-git]

@micschk
As Mautic is only for admin account if a user is already logged in then he can download any file from server via this attack.This attack is only valid for authenticated user and anonymous attacker cant exploit it. If your admin user are strusted then no need to temprary disable.

[micschk]

Great, thanks!