PT-2022-17503 · Mautic · Mautic

Sheikhrishad · Published 2022-05-25 · Updated 2023-05-09 · CVE-2022-25772

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.3.0

Description A cross-site scripting (XSS) vulnerability in the web tracking component allows remote attackers to inject executable javascript. The issue arises because the output of tracking metadata is not sufficiently filtered, leading to a vulnerable situation.

Recommendations For versions prior to 4.3.0, please upgrade to 4.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the web tracking component until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-25772

GHSA-PJPC-87MP-4332

Affected Products

Mautic

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-25772 · Security Note
• https://osv.dev/vulnerability/GHSA-pjpc-87mp-4332 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25772 · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-pjpc-87mp-4332 · Note
• https://github.com/mautic/mautic/commit/462eb596027fd949efbf9ac5cb2b376805e9d246 · Note
• https://t.me/cvenotify/50050 · Telegram Post
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00847.html · Note
• https://t.me/cvenotify/31897 · Telegram Post
• https://t.me/cibsecurity/44823 · Telegram Post