From cab21385c9f65560954ce6987a71d54e0fcc4592 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 18 Sep 2024 22:11:31 +0000
Subject: [PATCH] Publish GHSA-8vff-35qm-qjvv

---
 .../GHSA-8vff-35qm-qjvv.json                  | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/09/GHSA-8vff-35qm-qjvv/GHSA-8vff-35qm-qjvv.json

diff --git a/advisories/github-reviewed/2024/09/GHSA-8vff-35qm-qjvv/GHSA-8vff-35qm-qjvv.json b/advisories/github-reviewed/2024/09/GHSA-8vff-35qm-qjvv/GHSA-8vff-35qm-qjvv.json
new file mode 100644
index 00000000000..3a6cb4f3468
--- /dev/null
+++ b/advisories/github-reviewed/2024/09/GHSA-8vff-35qm-qjvv/GHSA-8vff-35qm-qjvv.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8vff-35qm-qjvv",
+  "modified": "2024-09-18T22:10:05Z",
+  "published": "2024-09-18T22:10:05Z",
+  "aliases": [
+    "CVE-2024-47059"
+  ],
+  "summary": "Mautic allows users enumeration due to weak password login",
+  "details": "### Summary\n\nWhen logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.\n\nThis difference could be used to perform username enumeration.\n\n### Patches\n\nUpdate to 5.1.1 or later.\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@mautic.org](mailto:security@mautic.org)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "mautic/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.1.0"
+            },
+            {
+              "fixed": "5.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mautic/mautic"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-204"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-18T22:10:05Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file