CVE-2022-25774: Mautic Core - Cross-Site Scripting in Notifications via Saving Dashboards
Summary
CVE-2022-25774: Mautic vulnerable to cross-site scripting in notifications via saving Dashboards. Affects mautic/core versions < 4.4.12. Fixed in 4.4.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic Core is an open-source marketing automation software that enables businesses to automate marketing campaigns and track customer interactions. It provides various features such as email marketing, lead management, and campaign tracking. Mautic allows users to create and save dashboards to visualize data and monitor marketing activities. However, prior to version 4.4.12, Mautic is vulnerable to a cross-site scripting (XSS) vulnerability in the notifications feature.
Vulnerability Detail
The XSS vulnerability in Mautic allows logged-in users to inject malicious code into the notifications when saving dashboards. This self XSS vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users who view the notifications. This can lead to various attacks, including session hijacking, defacement, and stealing sensitive information. The vulnerability has a CVSS score of 4.8.
How To Fix
Minimum fixed version
4.4.12
This is the first release that contains the fix.
composer require mautic/core:4.4.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the patch or update to the latest version of Mautic to mitigate the risk of exploitation.
Conclusion
The XSS vulnerability in Mautic Core allows logged-in users to inject malicious code into notifications, posing a risk of session hijacking, defacement, and data theft. To mitigate this vulnerability, it is crucial to update Mautic to version 4.4.12 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mautic/core →
FAQ
Mautic Core is an open-source marketing automation software used for managing marketing campaigns, lead generation, and tracking customer interactions.
The vulnerability allows logged-in users to inject malicious code into notifications, potentially leading to session hijacking, defacement, and data theft.
To fix the vulnerability, update Mautic to version 4.4.12 or later, which includes the necessary security patches.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the recommended solution.
You can find more information about this vulnerability in the official Mautic security advisory and the OWASP Top Ten 2017 guide on Cross-Site Scripting (XSS).
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
