PT-2021-19299 · Mautic · Mautic

Published 2021-01-29 · Updated 2021-01-29 · CVE-2021-3142

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 2.16.5 Mautic versions prior to 3.2.4

Description This issue relates to a cross-site scripting vulnerability that can be executed when creating or editing a company, requiring the user to be logged in as an administrator. The vulnerability was reported by Dardan Prebreza at Bishop Fox.

Recommendations Upgrade to version 2.16.5 or later for 2.x versions. Upgrade to version 3.2.4 or later for 3.x versions.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-3142

GHSA-P7V4-GM6J-CW9M

Affected Products

Mautic

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/mautic/core/CVE-2021-3142.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3142 · Security Note
• https://osv.dev/vulnerability/GHSA-p7v4-gm6j-cw9m · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-p7v4-gm6j-cw9m · Note
• https://github.com/mautic/mautic/releases/tag/3.2.4 · Note
• https://github.com/mautic/mautic/commit/ba31db23e664f889da55a29ff27f797e2ab5cb1b · Note
• https://mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 · Note
• https://mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-3 · Note