~ / search / GHSA-xv68-rrmw-9xwf

GHSA-xv68-rrmw-9xwf

Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-47058

Packages

EcosystemPackageAffectedFixed in
Packagist mautic/core >= 5.0.0-alpha, < 5.1.1 5.1.1
Packagist mautic/core >= 1.0.0-beta, < 4.4.13 4.4.13
Packagist mautic/core-lib >= 5.0.0-alpha, < 5.1.1 5.1.1
Packagist mautic/core-lib >= 1.0.0-beta, < 4.4.13 4.4.13

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session. ### Patches Upgrade to 4.4.13 or 5.1.1 or later. ### Workarounds None ### References - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting If you have any questions or comments about this advisory: Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.