CVE-2024-47058: Mautic Core Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2024-47058: Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field). Affects mautic/core across 2 version ranges.
>= 1.0.0-beta, < 4.4.13
>= 5.0.0-alpha, < 5.1.1
Fixed in 4.4.13 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns effectively. It provides features such as email marketing, landing page creation, and lead management. However, Mautic is vulnerable to a Cross-Site Scripting (XSS) attack, specifically in the edit form HTML field, which can be exploited by attackers with access to modify forms.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to inject malicious scripts into the HTML fields of Mautic forms. When a user accesses a compromised form, the injected script executes in their browser, potentially allowing the attacker to steal sensitive information from the user's session. This type of stored XSS can lead to unauthorized access to user data and compromise the integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0-beta, < 4.4.134.4.13composer require mautic/core:4.4.13 -
>= 5.0.0-alpha, < 5.1.15.1.1composer require mautic/core:5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to upgrade to the patched versions.
Conclusion
In summary, the CVE-2024-47058 vulnerability in Mautic exposes users to potential XSS attacks through compromised form fields. It is crucial for users to upgrade to the latest versions to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of open-source applications.
See every vulnerability recorded for mautic/core →
FAQ
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If exploited, this vulnerability can lead to the theft of sensitive user information, session hijacking, and unauthorized access to user accounts.
It is not safe to continue using an affected version, as it poses a significant security risk. Immediate upgrading is recommended.
The CVSS score of this vulnerability is 2.9, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
