PT-2024-32377 · Mautic · Mautic

Avikarsha Saha + 4 · Published 2024-09-18 · Updated 2024-09-27 · CVE-2024-47058

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1

Description With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the html field. This could be used to steal sensitive information from the user's current session.

Recommendations For versions prior to 4.4.13, upgrade to 4.4.13 or later. For versions prior to 5.1.1, upgrade to 5.1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47058

GHSA-XV68-RRMW-9XWF

Affected Products

Mautic

References · 10

• https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47058 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47058 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv68-rrmw-9xwf · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/344b908ef690283e7d8d3fc5cc1327396a1c3046 · Note
• https://github.com/mautic/mautic/commit/88153a15b3cea331b7036d956b880c69e81a0032 · Note
• https://t.me/cvedetector/6031 · Telegram Post
• https://t.me/cvenotify/96354 · Telegram Post
• https://twitter.com/CVEnew/status/1836534048476344693 · Twitter Post