Description
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mautic | Mautic | >= 1.0.0 – < < 4.4.13, >= 5.0.0 – < < 5.1.1 | < 4.4.13 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mautic/core | >= 5.0.0-alpha, < 5.1.1 | 5.1.1 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core | >= 1.0.0-beta, < 4.4.13 | 4.4.13 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core-lib | >= 5.0.0-alpha, < 5.1.1 | 5.1.1 | GHSA-xv68-rrmw-9xwf |
| Packagist | mautic/core-lib | >= 1.0.0-beta, < 4.4.13 | 4.4.13 | GHSA-xv68-rrmw-9xwf |