CVE-2021-27911

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc.

CVSS v3 8.3 HIGH
CVSS v2.0 4.3 MEDIUM

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc	Patch Third Party Advisory
https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:acquia:mautic::::::::
	cpe:2.3:a:acquia:mautic:4.0.0:alpha1::::::
	cpe:2.3:a:acquia:mautic:4.0.0:beta::::::
	cpe:2.3:a:acquia:mautic:4.0.0:rc::::::

History

21 Nov 2024, 05:58

Type	Values Removed	Values Added
CVSS	v2 : ~~4.3~~ v3 : ~~6.1~~	v2 : 4.3 v3 : 8.3
References	~~() https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc - Patch, Third Party Advisory~~	() https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc - Patch, Third Party Advisory

Information

Published : 2021-08-30 16:15

Updated : 2024-11-21 05:58

NVD link : CVE-2021-27911

Mitre link : CVE-2021-27911

CVE.ORG link : CVE-2021-27911

JSON object : View

Products Affected

acquia

mautic

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-27911", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "security@mautic.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-08-30T16:15:07.347", "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc", "tags": ["Patch", "Third Party Advisory"], "source": "security@mautic.org"}, {"url": "https://github.com/mautic/mautic/security/advisories/GHSA-72hm-fx78-xwhc", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@mautic.org", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc."}, {"lang": "es", "value": "Mautic versiones anteriores a 3.3.4/4.0.0, son vulnerables a un ataque de tipo inline JS XSS mediante el nombre o el apellido del contacto y es desencadenado cuando se visualiza la p\u00e1gina de detalles de un contacto y luego se hace clic en el desplegable de acciones y se pasa por encima del bot\u00f3n Campa\u00f1as. El nombre y los apellidos de los contactos pueden provenir de diferentes fuentes, como la interfaz de usuario, la API, la sincronizaci\u00f3n de terceros, los formularios, etc."}], "lastModified": "2024-11-21T05:58:46.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA7B8AF8-5929-4515-9EFF-9F589FA3FFDC", "versionEndExcluding": "3.3.4"}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4B8FCED-A690-45D0-ACE1-871ADA2080F3"}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14D56FFE-E768-4502-BA7E-6B34BFE463B4"}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C536B44B-C713-47D1-9EBD-E2D94CB0561E"}], "operator": "OR"}]}], "sourceIdentifier": "security@mautic.org"}