GitHub Advisoryadvisory · Packagist

GHSA-pjpc-87mp-4332 Cross-site Scripting vulnerability in Mautic's tracking pixel functionality

CRITICAL Published 2022-05-25 Modified 2022-05-25 Official page ↗
Aliases
CVE-2022-25772
Ecosystem
Packagist
Packages
mautic/core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Weaknesses
CWE-79
Reviewed
2022-05-25

Affected packages

• Packagist mautic/core: < 4.3.0 → fixed in 4.3.0

Description

Impact Mautic allows you to track open rates by using tracking pixels. The tracking information is stored together with extra metadata of the tracking request. The output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation. Patches Please upgrade to 4.3.0 Workarounds None. References • Internally tracked under MST-38 For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-25772 A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References