{"id":"CVE-2021-27908","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-27908","generatedAt":"2026-10-27T22:32:21.206Z","title":"In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are…","description":"In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.","published":"2021-03-23T20:15:13.000Z","lastModified":"2026-06-17T03:45:36.000Z","status":"Modified","sourceIdentifier":"security@mautic.org","cvss":{"version":"3.1","score":4.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-200","CWE-74"],"affected":["acquia/mautic"],"epss":{"score":0.00345,"percentile":0.27806,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx","tags":["Exploit","Third Party Advisory"],"source":"security@mautic.org"},{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-27908","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}