CVE-2020-35125: Mautic XSS Vulnerability
Summary
CVE-2020-35125: Mautic is vulnerable to XSS vulnerability. Affects mautic/core across 2 version ranges.
< 2.16.5
>= 3.0.0, < 3.2.4
Fixed in 2.16.5 or 3.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation software that allows businesses to automate marketing tasks and track customer interactions. It is widely used for managing email campaigns, lead generation, and customer relationship management. The Mautic Core package is a fundamental component of Mautic, providing core functionalities and features for the software.
Vulnerability Detail
The Mautic Core package is vulnerable to a cross-site scripting (XSS) vulnerability. This vulnerability affects all versions of Mautic and could potentially grant an attacker unauthorized administrator-level access to the Mautic system. The XSS vulnerability allows an attacker to inject malicious code into Mautic's web interface, which is then executed by unsuspecting users. This can lead to various malicious activities, such as stealing sensitive information, manipulating user data, or performing unauthorized actions within the Mautic system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.16.52.16.5composer require mautic/core:2.16.5 -
>= 3.0.0, < 3.2.43.2.4composer require mautic/core:3.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workarounds have been mentioned for this vulnerability. It is recommended to apply the provided patches or upgrade to the fixed versions as soon as possible.
Conclusion
The Mautic Core package is vulnerable to a critical XSS vulnerability that can grant unauthorized administrator-level access to the Mautic system. To mitigate this vulnerability, it is crucial to apply the provided patches or upgrade to the fixed versions. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mautic/core →
FAQ
This vulnerability allows an attacker to gain unauthorized administrator-level access to the Mautic system, potentially leading to data theft, manipulation, and unauthorized actions.
This vulnerability was discovered by Naveen Sunkavally at Horizon3.ai.
All versions of Mautic are affected by this XSS vulnerability.
No specific workarounds have been provided. It is recommended to apply the patches or upgrade to the fixed versions.
For more information, you can visit the Mautic support forum at https://forum.mautic.org/c/support. You can also reach out to the Mautic security team via email at security@mautic.org.
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
