TI-2021-09245 Aliases CVE-2021-27910 GHSA-86pv-95mj-7w5f

Stored XSS vulnerability on Bounce Management Callback

LOW 37CWE-79Published 2021-08-30 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.

Why it matters now

EPSS 0.00699 53rd percentileScored 2026-11-07

Fix Fixed Mautic (Mautic): 3.3.4, 4.0.0mautic/core (Packagist): 3.3.4, 4.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mautic	Mautic	before 3.3.4; before 4.0.0	3.3.4, 4.0.0	Patch available	CNA
—	mautic/core (Packagist)	before 3.3.4	3.3.4	Patch available	GHSA-86pv-95mj-7w5f
—	mautic/core (Packagist)	4.0.0-alpha1 to before 4.0.0	4.0.0	Patch available	GHSA-86pv-95mj-7w5f

Mautic VendorMautic Affected before 3.3.4; before 4.0.0 Fixed in 3.3.4, 4.0.0 Patch available CNA
mautic/core (Packagist) Vendor— Affected before 3.3.4 Fixed in 3.3.4 Patch available GHSA-86pv-95mj-7w5f
mautic/core (Packagist) Vendor— Affected 4.0.0-alpha1 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-86pv-95mj-7w5f

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:acquia:mautic::::::::	before 3.3.4	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:alpha1::::::	4.0.0 alpha1	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:beta::::::	4.0.0 beta	Vulnerable	Acquia
cpe:2.3:a:acquia:mautic:4.0.0:rc::::::	4.0.0 rc	Vulnerable	Acquia

cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions before 3.3.4 Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Acquia
cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:* Versions 4.0.0 rc Vulnerable ·Acquia

Remediation

Fix · CNA Mautic (Mautic) Fixed in 3.3.4, 4.0.0
Fix · GHSA-86pv-95mj-7w5f mautic/core (Packagist) Fixed in 3.3.4 Advisory →
Fix · GHSA-86pv-95mj-7w5f mautic/core (Packagist) Fixed in 4.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-08-30
Mautic 3.3.4, 4.0.0
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2021-09246 XSS vulnerability on contacts viewPriority LOW 37
- TI-2021-09244 XSS vulnerability on password reset pagePriority LOW 35
- TI-2021-09247 XSS vulnerability on asset viewPriority LOW 32
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-27910
2026-10-03 Alias added: GHSA-86pv-95mj-7w5f

References

Patch 1

https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-27910

Other 3

TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences