CVE-2024-47057: Mautic · Observable Discrepancy
Affects MauticSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 28 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubmautic/mauticpkg:github/mautic/mauticOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
1. Upgrade Mautic to the latest version that addresses the timing discrepancy in the password reset functionality, ensuring uniform response times regardless of username validity. 2. Implement strict rate limiting and throttling on the password reset endpoint to prevent automated enumeration attempts. 3. Employ web application firewalls (WAFs) with rules designed to detect and block timing attack patterns or excessive requests to the password reset feature. 4. Monitor logs for unusual activity patterns related to password reset requests, such as high-frequency attempts from single IP addresses or distributed sources. 5. Educate users and administrators about the risks of username enumeration and encourage strong, unique passwords combined with multi-factor authentication (MFA) to mitigate risks from credential-based attacks. 6. Consider additional application-level mitigations such as introducing random delays or uniform error messages to further obscure user existence information.
Description
SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack. MitigationPlease update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.