CVE-2025-9824

{
  "id": "CVE-2025-9824",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-03T15:15:49.413",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.\n\nPatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.\n\nTechnical DetailsThe vulnerability was caused by different response times when:\n\n  *  A valid username was provided (password hashing occurred)\n  *  An invalid username was provided (no password hashing occurred)\n\n\nThe fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.\n\nWorkaroundsNo workarounds are available. Users should upgrade to the patched version.\n\nReferences  *   https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account"
    },
    {
      "lang": "es",
      "value": "Impacto\nEl atacante puede validar si un usuario existe comprobando el tiempo que devuelve el inicio de sesión. Esta diferencia de tiempo puede ser utilizada para enumerar nombres de usuario válidos, después de lo cual un atacante podría intentar ataques de fuerza bruta.\n\nParches\nEsta vulnerabilidad ha sido parcheada, implementando un autenticador de inicio de sesión de formulario seguro contra ataques de temporización que asegura tiempos de respuesta consistentes independientemente de si un usuario existe o no.\n\nDetalles Técnicos\nLa vulnerabilidad fue causada por diferentes tiempos de respuesta cuando:\n\n  *  Se proporcionó un nombre de usuario válido (se realizó el hash de la contraseña)\n  *  Se proporcionó un nombre de usuario inválido (no se realizó el hash de la contraseña)\n\nLa solución introduce un TimingSafeFormLoginAuthenticator que realiza una verificación de hash de contraseña ficticia incluso para usuarios inexistentes, asegurando una temporización consistente.\n\nSoluciones provisionales\nNo hay soluciones provisionales disponibles. Los usuarios deben actualizar a la versión parcheada.\n\nReferencias\n  *   https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mautic",
          "product": "Mautic",
          "defaultStatus": "unaffected",
          "collectionURL": "https://packagist.org",
          "packageName": "mautic/core",
          "repo": "https://github.com/mautic/mautic",
          "versions": [
            {
              "version": ">= 4.4.0",
              "lessThan": "< 4.4.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0-alpha",
              "lessThan": "< 5.2.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0-alpha",
              "lessThan": "< 6.0.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-03T14:45:46.949698Z",
          "id": "CVE-2025-9824",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-204"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg",
      "source": "[email protected]"
    }
  ]
}