Vulnerability · Published Sep 18, 2024 · Assigned by Mautic
CVE-2024-47058Cross-site Scripting (XSS) - stored (edit form HTML field)
Low 2.9
In plain English
A low-severity cross-site scripting in Mautic from Mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.2%top 88.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 5.1.1 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core | 4.4.13 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core-lib | 5.1.1 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core-lib | 4.4.13 | GHSA-xv68-rrmw-9xwf |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L