TI-2021-09244 Aliases CVE-2021-27909 GHSA-32hw-3pvh-vcvc

XSS vulnerability on password reset page

LOW 35CWE-79Published 2021-08-30 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.

Why it matters now

EPSS 0.04067 90th percentileScored 2026-11-07

Fix Fixed Mautic (Mautic): 3.3.4, 4.0.0mautic/core (Packagist): 3.3.4, 4.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mautic	Mautic	before 3.3.4; before 4.0.0	3.3.4, 4.0.0	Patch available	CNA
—	mautic/core (Packagist)	before 3.3.4	3.3.4	Patch available	GHSA-32hw-3pvh-vcvc
—	mautic/core (Packagist)	4.0.0-alpha1 to before 4.0.0	4.0.0	Patch available	GHSA-32hw-3pvh-vcvc

Mautic VendorMautic Affected before 3.3.4; before 4.0.0 Fixed in 3.3.4, 4.0.0 Patch available CNA
mautic/core (Packagist) Vendor— Affected before 3.3.4 Fixed in 3.3.4 Patch available GHSA-32hw-3pvh-vcvc
mautic/core (Packagist) Vendor— Affected 4.0.0-alpha1 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-32hw-3pvh-vcvc

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:acquia:mautic::::::::	before 3.3.4	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:alpha1::::::	4.0.0 alpha1	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:beta::::::	4.0.0 beta	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:rc::::::	4.0.0 rc	Vulnerable	Acquia

cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions before 3.3.4 Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:* Versions 4.0.0 rc Vulnerable ·Acquia

Remediation

Fix · CNA Mautic (Mautic) Fixed in 3.3.4, 4.0.0
Fix · GHSA-32hw-3pvh-vcvc mautic/core (Packagist) Fixed in 3.3.4 Advisory →
Fix · GHSA-32hw-3pvh-vcvc mautic/core (Packagist) Fixed in 4.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-08-30
Mautic 3.3.4, 4.0.0
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2021-09246 XSS vulnerability on contacts viewPriority LOW 37
- TI-2021-09245 Stored XSS vulnerability on Bounce Management CallbackPriority LOW 37
- TI-2021-09247 XSS vulnerability on asset viewPriority LOW 32
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-27909
2026-10-03 Alias added: GHSA-32hw-3pvh-vcvc

References

Patch 1

https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-27909

Other 3

TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences