PT-2022-9879 · Mautic · Mautic

Published 2022-06-01 · Updated 2022-06-08 · CVE-2021-27914

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.3.0

Description A cross-site scripting (XSS) vulnerability in the installer component of Mautic allows admins to inject executable javascript.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the installer component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27914

GHSA-JRWM-PR9X-CGQ3

Affected Products

Mautic

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-27914 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27914 · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-jrwm-pr9x-cgq3 · Note
• https://t.me/cibsecurity/43611 · Telegram Post
• https://t.me/cvenotify/30964 · Telegram Post
• https://t.me/cvenotify/30982 · Telegram Post