Vulnerability · Published Jan 19, 2021 · Assigned by mitre
CVE-2020-35129
Critical 9.0
In plain English
A critical-severity security flaw in the mautic/core package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 3.2.4 | GHSA-3px5-wjh3-9x6r |
Affected products (as reported)
References
- https://forum.mautic.org/c/announcements/16 x_refsource_MISC
- https://labs.bishopfox.com/advisories/mautic-version-3.2.2 x_refsource_MISC