Skip to content

XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic

Critical severity GitHub Reviewed Published Jan 14, 2021 in mautic/mautic • Updated Feb 5, 2024

Package

composer mautic/core (Composer)

Affected versions

>= 3.0.0, < 3.2.4
>= 2.0.0, < 2.16.5

Patched versions

3.2.4
2.16.5

Description

Impact

This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic.

This vulnerability was reported by Naveen Sunkavally at Horizon3.ai.

Patches

Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

Workarounds

None

For more information

If you have any questions or comments about this advisory:

References

@RCheesley RCheesley published to mautic/mautic Jan 14, 2021
Reviewed Jan 19, 2021
Published to the GitHub Advisory Database Jan 19, 2021
Published by the National Vulnerability Database Jan 28, 2021
Last updated Feb 5, 2024

Severity

Critical

EPSS score

0.371%
(73rd percentile)

Weaknesses

CVE ID

CVE-2020-35124

GHSA ID

GHSA-39wj-j3jc-858m

Source code

No known source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.