GitHub Advisoryadvisory · Packagist

GHSA-72hm-fx78-xwhc XSS vulnerability on contacts view

HIGH Published 2021-09-01 Modified 2021-08-30 Official page ↗
Aliases
CVE-2021-27911
Ecosystem
Packagist
Packages
mautic/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2021-08-30

Affected packages

• Packagist mautic/core: < 3.3.4 → fixed in 3.3.4 • Packagist mautic/core: >= 4.0.0-alpha1, < 4.0.0 → fixed in 4.0.0

Description

Impact Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. Patches Upgrade to 3.3.4 or 4.0.0 Workarounds No References https://github.com/mautic/mautic/releases/tag/3.3.4 https://github.com/mautic/mautic/releases/tag/4.0.0 For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-27911 Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References