Vulnerability · Published Aug 30, 2021 · Assigned by Mautic
CVE-2021-27911XSS vulnerability on contacts view
High 8.3
In plain English
A high-severity cross-site scripting in Mautic from Mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 3.3.4 | GHSA-72hm-fx78-xwhc |
| Packagist | mautic/core | 4.0.0 | GHSA-72hm-fx78-xwhc |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H