GHSA-3fq7-c5m8-g86x
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mautic/core | >= 4.0.0, < 4.4.18 | 4.4.18 |
| Packagist | mautic/core | >= 5.0.0, < 5.2.9 | 5.2.9 |
| Packagist | mautic/core | >= 6.0.0, < 6.0.7 | 6.0.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.
### Impact
A low-privileged user of the platform can install malicious code to obtain higher privileges.
References
External links from the advisory. They lead to third-party sites.