Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Mautic < 4.4.13, < 5.1.1 Clear all filters
TI-2021-09252 CVE-2021-27917 · GHSA-xpc5-rr39-v8v2

XSS in contact tracking and page hits report

Priority LOW 32

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00291 Published 2024-09-18 Fixed in < 4.4.13, < 5.1.1 +2 CWE-79
TI-2024-31434 CVE-2024-47050 · GHSA-73gr-32wg-qhh7

XSS in contact/company tracking (no authentication)

Priority LOW 27

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00308 Published 2024-09-18 Fixed in < 4.4.13, < 5.1.1 +2 CWE-79
TI-2024-31440 CVE-2024-47058 · GHSA-xv68-rrmw-9xwf

Cross-site Scripting (XSS) - stored (edit form HTML field)

Priority LOW 21

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00209 Published 2024-09-18 Fixed in < 4.4.13, < 5.1.1 +2 CWE-79
TI-2022-09341 CVE-2022-25768 · GHSA-x3jx-5w6m-q2fc

Improper Access Control in UI upgrade process

Priority LOW 31

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00289 Published 2024-09-18 Fixed in < 4.4.13, < 5.1.1 +2 CWE-287