Avikarsha Saha

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 **Description** With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the `html` field. This could be used to steal sensitive information from the user's current session. **Recommendations** For versions prior to 4.4.13, upgrade to 4.4.13 or later. For versions prior to 5.1.1, upgrade to 5.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic. **Recommendations** Update to version 4.4.12 or later. Update to version 5.0.4 or later. As a temporary workaround, consider restricting access to the GrapesJS builder in Mautic until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 **Description** Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. **Recommendations** Update to version 4.4.12 to resolve the issue for versions prior to 4.4.12. Update to version 5.0.4 to resolve the issue for versions prior to 5.0.4.