PT-2019-8778 · Mautic · Mautic

Joanbono · Published 2019-09-20 · Updated 2021-01-19 · CVE-2018-11200

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions 2.11.0 and earlier Mautic version 2.13.1

Description An issue was discovered that allows for Stored XSS via the company name field. This Cross Site Scripting (XSS) vulnerability can result in denial of service and execution of javascript code.

Recommendations For Mautic versions 2.11.0 and earlier, update to 2.14.0 or later. For Mautic version 2.13.1, update to 2.14.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11200

GHSA-9HX7-RG7W-XM79

Affected Products

Mautic

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-11200 · Security Note
• https://osv.dev/vulnerability/GHSA-9hx7-rg7w-xm79 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11200 · Vendor Advisory
• https://github.com/mautic/mautic/releases/tag/2.14.0 · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-9hx7-rg7w-xm79 · Note