CVE-2025-9822

{
  "id": "CVE-2025-9822",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-03T14:15:46.247",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.\n\nImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them."
    },
    {
      "lang": "es",
      "value": "ResumenUn usuario con derechos de administrador puede cambiar la configuración de la aplicación mautic y extraer secretos que normalmente no están disponibles.\n\nImpactoUn administrador que normalmente no tiene acceso a ciertos parámetros, como las credenciales de la base de datos, puede revelarlos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mautic",
          "product": "Mautic",
          "defaultStatus": "unaffected",
          "collectionURL": "https://packagist.org",
          "packageName": "mautic/core",
          "repo": "https://github.com/mautic/mautic",
          "versions": [
            {
              "version": ">= 4.4.0",
              "lessThan": "< 4.4.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0-alpha",
              "lessThan": "< 5.2.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0-alpha",
              "lessThan": "< 6.0.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-03T14:08:49.982448Z",
          "id": "CVE-2025-9822",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-283"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w",
      "source": "[email protected]"
    }
  ]
}