Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.
References
| Link | Resource |
|---|---|
| https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
| https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786 | Exploit Vendor Advisory |
| https://labs.bishopfox.com/advisories/mautic-version-3.2.2 | Third Party Advisory |
| https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
| https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786 | Exploit Vendor Advisory |
| https://labs.bishopfox.com/advisories/mautic-version-3.2.2 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://forum.mautic.org/c/announcements/16 - Vendor Advisory | |
| References | () https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786 - Exploit, Vendor Advisory | |
| References | () https://labs.bishopfox.com/advisories/mautic-version-3.2.2 - Third Party Advisory |
Information
Published : 2021-01-19 14:15
Updated : 2024-11-21 05:26
NVD link : CVE-2020-35128
Mitre link : CVE-2020-35128
CVE.ORG link : CVE-2020-35128
JSON object : View
Products Affected
acquia
- mautic
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')