CVE-2025-9824

{"id": "CVE-2025-9824", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9824", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-03T14:45:46.949698Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@mautic.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@mautic.org", "affectedData": [{"repo": "https://github.com/mautic/mautic", "vendor": "Mautic", "product": "Mautic", "versions": [{"status": "affected", "version": ">= 4.4.0", "lessThan": "< 4.4.17", "versionType": "semver"}, {"status": "affected", "version": ">= 5.0.0-alpha", "lessThan": "< 5.2.8", "versionType": "semver"}, {"status": "affected", "version": ">= 6.0.0-alpha", "lessThan": "< 6.0.5", "versionType": "semver"}], "packageName": "mautic/core", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2025-09-03T15:15:49.413", "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg", "source": "security@mautic.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@mautic.org", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.\n\nPatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.\n\nTechnical DetailsThe vulnerability was caused by different response times when:\n\n * A valid username was provided (password hashing occurred)\n * An invalid username was provided (no password hashing occurred)\n\n\nThe fix introduces a TimingSafeFormLoginAuthenticator\u00a0that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.\n\nWorkaroundsNo workarounds are available. Users should upgrade to the patched version.\n\nReferences * https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account"}, {"lang": "es", "value": "Impacto\nEl atacante puede validar si un usuario existe comprobando el tiempo que devuelve el inicio de sesi\u00f3n. Esta diferencia de tiempo puede ser utilizada para enumerar nombres de usuario v\u00e1lidos, despu\u00e9s de lo cual un atacante podr\u00eda intentar ataques de fuerza bruta.\n\nParches\nEsta vulnerabilidad ha sido parcheada, implementando un autenticador de inicio de sesi\u00f3n de formulario seguro contra ataques de temporizaci\u00f3n que asegura tiempos de respuesta consistentes independientemente de si un usuario existe o no.\n\nDetalles T\u00e9cnicos\nLa vulnerabilidad fue causada por diferentes tiempos de respuesta cuando:\n\n * Se proporcion\u00f3 un nombre de usuario v\u00e1lido (se realiz\u00f3 el hash de la contrase\u00f1a)\n * Se proporcion\u00f3 un nombre de usuario inv\u00e1lido (no se realiz\u00f3 el hash de la contrase\u00f1a)\n\nLa soluci\u00f3n introduce un TimingSafeFormLoginAuthenticator que realiza una verificaci\u00f3n de hash de contrase\u00f1a ficticia incluso para usuarios inexistentes, asegurando una temporizaci\u00f3n consistente.\n\nSoluciones provisionales\nNo hay soluciones provisionales disponibles. Los usuarios deben actualizar a la versi\u00f3n parcheada.\n\nReferencias\n * https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account"}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "security@mautic.org"}