GitHub Advisoryadvisory · Packagist

GHSA-p7v4-gm6j-cw9m XSS in Mautic

HIGH Published 2021-01-29 Modified 2021-01-29 Official page ↗
Aliases
CVE-2021-3142
Ecosystem
Packagist
Packages
mautic/core
Severity
High
Weaknesses
CWE-79
Reviewed
2021-01-29

Affected packages

• Packagist mautic/core: >= 3.0.0, < 3.2.4 → fixed in 3.2.4 • Packagist mautic/core: >= 2.0.0, < 2.16.5 → fixed in 2.16.5

Description

Impact This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed. This vulnerability was reported by Dardan Prebreza at Bishop Fox. Patches Upgrade to 3.2.4 or 2.16.5. Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff Workarounds None References https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 For more information If you have any questions or comments about this advisory: • Post in https://forum.mautic.org/c/support • Email us at [email protected]

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References