CVE-2020-35128: Mautic stored Cross-site Scripting (XSS)
Summary
CVE-2020-35128: Mautic stored Cross-site Scripting (XSS). Affects mautic/core across 2 version ranges.
>= 2.0.0, < 2.16.5
>= 3.2.0, < 3.2.4
Fixed in 2.16.5 or 3.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation software that allows businesses to automate marketing campaigns and track customer interactions. It provides features such as lead management, email marketing, social media marketing, and more. The Mautic core package is a fundamental component of the Mautic software stack.
Vulnerability Detail
Mautic versions before 3.2.4 are vulnerable to stored XSS (Cross-site Scripting) attacks. This vulnerability allows an attacker with permission to manage companies, a feature within the application, to target other users, including administrators. By loading a specially crafted JavaScript file, the attacker can execute malicious actions on behalf of the target user. These actions include changing user passwords, modifying user or email addresses, or even adding a new administrator to the system. The stored XSS vulnerability poses a significant risk to the integrity and security of the Mautic application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.16.52.16.5composer require mautic/core:2.16.5 -
>= 3.2.0, < 3.2.43.2.4composer require mautic/core:3.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Mautic version 3.2.4 or later.
Conclusion
Mautic versions before 3.2.4 are susceptible to a stored XSS vulnerability that can be exploited by attackers with permission to manage companies. Upgrading to Mautic version 3.2.4 or later is crucial to mitigate the risk of unauthorized access and protect the integrity of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mautic/core →
FAQ
Mautic is an open-source marketing automation software that enables businesses to automate marketing campaigns and track customer interactions.
Stored XSS (Cross-site Scripting) is a type of vulnerability that allows an attacker to inject malicious scripts into a target website or application. These scripts are then executed by unsuspecting users, potentially leading to unauthorized actions or data theft.
Mautic versions before 3.2.4 are affected by this vulnerability. Users of Mautic should upgrade to the latest version to protect their systems.
An attacker exploiting this vulnerability can perform various malicious actions on behalf of the target user, including changing passwords, modifying user or email addresses, or adding new administrators to the system.
To fix this vulnerability, upgrade Mautic to version 3.2.4 or later. This version includes the necessary security patches to address the stored XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
