PT-2021-11713 · Mautic · Mautic

Dardan Prebreza · Published 2021-01-19 · Updated 2022-05-24 · CVE-2020-35129

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.2.4

Description: The issue affects Mautic, allowing an attacker with access to the Social Monitoring feature to perform stored XSS attacks on other users, including administrators. This could enable the attacker to load an externally drafted JavaScript file, potentially allowing them to change the target user's password or email address, or even elevate their own user role from a low-privileged user to an administrator account.

Recommendations: For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Social Monitoring feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35129

GHSA-3PX5-WJH3-9X6R

Affected Products

Mautic

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-35129 · Security Note
• https://forum.mautic.org/c/announcements/16 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3px5-wjh3-9x6r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35129 · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://labs.bishopfox.com/advisories/mautic-version-3.2.2 · Note
• https://t.me/cvenotify/8677 · Telegram Post
• https://t.me/cibsecurity/22262 · Telegram Post