Critical CVE-2020-35124 EUVD-2021-0482GHSA-39wj-j3jc-858m

XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic

Published Jan 28, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: mautic/core Ecosystem: Packagist

Description

A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	mautic/core	>= 3.0.0, < 3.2.4	3.2.4	GHSA-39wj-j3jc-858m
Packagist	mautic/core	>= 2.0.0, < 2.16.5	2.16.5	GHSA-39wj-j3jc-858m

References

https://forum.mautic.org/c/announcements/16
https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4
https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce
https://github.com/mautic/mautic/security/advisories/GHSA-39wj-j3jc-858m