CVE-2020-35129: Mautic stored Cross-site Scripting (XSS)
Summary
CVE-2020-35129: Mautic stored Cross-site Scripting (XSS). Affects mautic/core versions < 3.2.4. Fixed in 3.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation software that allows organizations to automate marketing tasks and track customer engagement. It provides features such as email marketing, lead management, social media monitoring, and more. The Mautic core package is a fundamental component of the Mautic software stack.
Vulnerability Detail
Mautic before version 3.2.4 is vulnerable to stored Cross-site Scripting (XSS) attacks. This type of vulnerability allows an attacker with access to the Social Monitoring feature to inject malicious scripts into the application. By doing so, the attacker can target other users, including administrators. For example, an attacker could load an externally crafted JavaScript file that would enable them to perform unauthorized actions on the target user's behalf. These actions could include changing the user's password or email address, or even elevating the attacker's user role to gain administrator privileges. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system.
How To Fix
Minimum fixed version
3.2.4
This is the first release that contains the fix.
composer require mautic/core:3.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to the fixed version to address the issue effectively.
Conclusion
Mautic before version 3.2.4 is vulnerable to stored Cross-site Scripting (XSS), which can be exploited by an attacker with access to the Social Monitoring feature. To address this issue, users should upgrade to Mautic version 3.2.4 or later. It is important to promptly apply the necessary security patches to protect the confidentiality, integrity, and availability of the system. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mautic/core →
FAQ
Mautic is an open-source marketing automation software that helps organizations automate marketing tasks and track customer engagement.
Stored Cross-site Scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious scripts into a web application. These scripts are then executed when other users access the affected page, potentially leading to unauthorized actions or data theft.
An attacker with access to the Social Monitoring feature in Mautic could inject malicious scripts into the application. These scripts would be executed when other users, including administrators, access the affected page, allowing the attacker to perform unauthorized actions on their behalf.
The stored XSS vulnerability in Mautic can lead to various consequences, including unauthorized access to user accounts, manipulation of user data, and potential privilege escalation. An attacker could change passwords, email addresses, or even gain administrator privileges, compromising the security and integrity of the affected system.
To protect your Mautic installation, it is crucial to upgrade to version 3.2.4 or later. Regularly applying security patches and keeping the software up to date is essential to mitigate the risk of known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
