Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
References
Link | Resource |
---|---|
https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
https://labs.bishopfox.com/advisories/mautic-version-3.2.2 | Third Party Advisory |
https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
https://labs.bishopfox.com/advisories/mautic-version-3.2.2 | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:26
Type | Values Removed | Values Added |
---|---|---|
References | () https://forum.mautic.org/c/announcements/16 - Vendor Advisory | |
References | () https://labs.bishopfox.com/advisories/mautic-version-3.2.2 - Third Party Advisory |
Information
Published : 2021-01-19 14:15
Updated : 2024-11-21 05:26
NVD link : CVE-2020-35129
Mitre link : CVE-2020-35129
CVE.ORG link : CVE-2020-35129
JSON object : View
Products Affected
mautic
- mautic
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')