XSS vulnerability on asset view
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.
Why it matters now
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Fixed Mautic (Mautic): 3.3.4, 4.0.0mautic/core (Packagist): 3.3.4, 4.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mautic | Mautic | before 3.3.4; before 4.0.0 | 3.3.4, 4.0.0 | Patch available | CNA |
| — | mautic/core (Packagist) | before 3.3.4 | 3.3.4 | Patch available | GHSA-rh5w-82wh-jhr8 |
| — | mautic/core (Packagist) | 4.0.0-alpha1 to before 4.0.0 | 4.0.0 | Patch available | GHSA-rh5w-82wh-jhr8 |
- Mautic VendorMautic Affected before 3.3.4; before 4.0.0 Fixed in 3.3.4, 4.0.0 Patch available CNA
- mautic/core (Packagist) Vendor— Affected before 3.3.4 Fixed in 3.3.4 Patch available GHSA-rh5w-82wh-jhr8
- mautic/core (Packagist) Vendor— Affected 4.0.0-alpha1 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-rh5w-82wh-jhr8
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* | before 3.3.4 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:* | 4.0.0 alpha1 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:* | 4.0.0 beta | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:* | 4.0.0 rc | Vulnerable | Acquia |
- cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions before 3.3.4 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:* Versions 4.0.0 rc Vulnerable ·Acquia
Remediation
- Fix · CNA Mautic (Mautic) Fixed in 3.3.4, 4.0.0
- Fix · GHSA-rh5w-82wh-jhr8 mautic/core (Packagist) Fixed in 3.3.4 Advisory →
- Fix · GHSA-rh5w-82wh-jhr8 mautic/core (Packagist) Fixed in 4.0.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mautic 3.3.4, 4.0.0
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2021-09246 XSS vulnerability on contacts viewPriority LOW 37
- TI-2021-09245 Stored XSS vulnerability on Bounce Management CallbackPriority LOW 37
- TI-2021-09244 XSS vulnerability on password reset pagePriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27912
- 2026-10-03 Alias added: GHSA-rh5w-82wh-jhr8
References
More Mautic vulnerabilities
- TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
- TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
- TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
- TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
- TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
- TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2021-27912 · CVE Program
- CVE-2021-27912 · NVD
- FIRST EPSS
- GHSA-rh5w-82wh-jhr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences