PT-2019-8777 · Mautic · Mautic

Joanbono · Publicado 2019-09-06 · Atualizado 2021-01-25 · CVE-2018-11198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic version 2.13.1

Description An issue was discovered in Mautic where there is Stored XSS via the authorUrl field in config.json. This affects the Author URL of themes.

Recommendations For Mautic version 2.13.1, update to version 2.14 or later. As a temporary workaround, consider restricting access to the authorUrl field in config.json to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11198

GHSA-XCF7-CJ8Q-PCJM

Produtos afetados

Mautic

Referências · 7

• https://github.com/mautic/mautic/security/advisories/GHSA-xcf7-cj8q-pcjm · Nota
• https://github.com/mautic/mautic/releases/tag/2.14.0 · Nota
• https://github.com/mautic/mautic/releases · Nota
• https://osv.dev/vulnerability/CVE-2018-11198 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11198 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xcf7-cj8q-pcjm · Aviso do Fabricante
• https://t.me/cibsecurity/6588 · Publicação no Telegram