PT-2019-8777 · Mautic · Mautic

Joanbono · Published 2019-09-06 · Updated 2021-01-25 · CVE-2018-11198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic version 2.13.1

Description An issue was discovered in Mautic where there is Stored XSS via the authorUrl field in config.json. This affects the Author URL of themes.

Recommendations For Mautic version 2.13.1, update to version 2.14 or later. As a temporary workaround, consider restricting access to the authorUrl field in config.json to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11198

GHSA-XCF7-CJ8Q-PCJM

Affected Products

Mautic

References · 7

• https://osv.dev/vulnerability/CVE-2018-11198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11198 · Security Note
• https://osv.dev/vulnerability/GHSA-xcf7-cj8q-pcjm · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-xcf7-cj8q-pcjm · Note
• https://github.com/mautic/mautic/releases/tag/2.14.0 · Note
• https://github.com/mautic/mautic/releases · Note
• https://t.me/cibsecurity/6588 · Telegram Post