PT-2021-17664 · Mautic · Mautic

Rcheesley · Published 2021-08-30 · Updated 2021-09-10 · CVE-2021-27910

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0

Description: Insufficient sanitization/filtering allows for arbitrary JavaScript injection in Mautic using the bounce management callback function. An attacker can inject arbitrary JavaScript code into the error and error related to parameters of the POST request (POST /mailer/<product / webhook>/callback) without needing authentication. The injected JavaScript code is stored permanently and executed when an authenticated user views the details page of an affected lead, potentially allowing for information theft or tampering.

Recommendations: Upgrade to version 3.3.4 or 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the bounce management callback function until the upgrade is applied. Avoid using the error and error related to parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27910

GHSA-86PV-95MJ-7W5F

Affected Products

Mautic

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/mautic/core/CVE-2021-27910.yaml · Exploit
• https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f · Patch
• https://osv.dev/vulnerability/CVE-2021-27910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27910 · Security Note
• https://osv.dev/vulnerability/GHSA-86pv-95mj-7w5f · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/e6a405975342f3cf86aa71927618d31d25135fa3 · Note