CVE-2024-47050: Mautic Core XSS Vulnerability in Contact/Company Tracking
Summary
CVE-2024-47050: Mautic vulnerable to XSS in contact/company tracking (no authentication). Affects mautic/core across 2 version ranges.
>= 2.6.0, < 4.4.13
>= 5.0.0-alpha, < 5.1.1
Fixed in 4.4.13 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns effectively. It provides features such as email marketing, lead management, and customer tracking. However, prior to the patch, Mautic's tracking functionality was susceptible to Cross-Site Scripting (XSS) attacks, which could compromise user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper handling of the Page URL variable in Mautic's tracking system. This oversight allows attackers to inject malicious scripts into the application, potentially leading to unauthorized access to sensitive information, session hijacking, and other malicious activities. The vulnerability is classified under CWE-79, indicating a flaw in input validation that can be exploited without authentication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 4.4.134.4.13composer require mautic/core:4.4.13 -
>= 5.0.0-alpha, < 5.1.15.1.1composer require mautic/core:5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only effective solution is to update to the patched versions mentioned.
Conclusion
In summary, the XSS vulnerability in Mautic's tracking system poses significant risks to user data and application security. It is crucial for users to update their installations to the latest versions to protect against potential exploits. Regular monitoring using tools like Vulert can help maintain the security of open-source applications.
See every vulnerability recorded for mautic/core →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) flaw that allows attackers to inject malicious scripts via the Page URL variable.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If exploited, this vulnerability can lead to data theft, session hijacking, and unauthorized access to user accounts.
Yes, updating to Mautic version 4.4.13 or 5.1.1 or later will mitigate the vulnerability.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
