CVE-2021-27908

Mautic vulnerable to secret data exfiltration via symfony parameters

Workarounds

No

References

No

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]

Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.

For example,

1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: <script> console.log("db password is: %mautic.db_password%"); </script>
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: db password is: <real password>

Risk rating: ModerateCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

A file, directory, or other resource is assigned permissions that allow broader access than intended. Typical impact: unauthorized read, modification, or execution of the resource.

CVE-2021-27908 has a CVSS score of 5.8 (Medium). The vector is requires local access, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.3.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Upgrade to 3.3.2

1. What is CVE-2021-27908? CVE-2021-27908 is a medium-severity incorrect permission assignment for critical resource vulnerability in mautic/core (composer), affecting versions < 3.3.2. It is fixed in 3.3.2. A file, directory, or other resource is assigned permissions that allow broader access than intended.
2. How severe is CVE-2021-27908? CVE-2021-27908 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of mautic/core are affected by CVE-2021-27908? mautic/core (composer) versions < 3.3.2 is affected.
4. Is there a fix for CVE-2021-27908? Yes. CVE-2021-27908 is fixed in 3.3.2. Upgrade to this version or later.
5. Is CVE-2021-27908 exploitable, and should I be worried? Whether CVE-2021-27908 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2021-27908 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2021-27908? Upgrade mautic/core to 3.3.2 or later.

Other vulnerabilities in mautic/core