GitHub Advisoryadvisory · Packagist

GHSA-qjhr-c23f-w76q Inline JS XSS vulnerability in Mautic

MEDIUM Published 2021-01-19 Modified 2021-01-19 Official page ↗
Aliases
CVE-2017-1000488
Ecosystem
Packagist
Packages
mautic/core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-01-19

Affected packages

• Packagist mautic/core: >= 2.1.0, < 2.12.0 → fixed in 2.12.0

Description

Impact Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form. Patches Upgrade to 2.12.0 or later. Workarounds None References https://github.com/mautic/mautic/releases/tag/2.12.0 For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2017-1000488 Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References