CVE-2017-1000488: XSS
Published Jan 3, 2018
·Updated
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
Affected Software
24 affected components
Acquia Mautic=2.1.0
Acquia Mautic=2.1.1
Acquia Mautic=2.2.0
Acquia Mautic=2.2.1
Acquia Mautic=2.3.0
Acquia Mautic=2.4.0
Acquia Mautic=2.5.0
Acquia Mautic=2.5.1
Acquia Mautic=2.6.0
Acquia Mautic=2.6.1
Acquia Mautic=2.7.0
Acquia Mautic=2.7.1
Acquia Mautic=2.8.0
Acquia Mautic=2.8.1
Acquia Mautic=2.8.2
Acquia Mautic=2.9.0-beta
Acquia Mautic=2.9.1
Acquia Mautic=2.10.0-beta
Acquia Mautic=2.10.1
Acquia Mautic=2.11.0-beta
Mautic Mautic=2.9.0
Mautic Mautic=2.9.2
Mautic Mautic=2.10.0
Mautic Mautic=2.11.0
Event History
Jan 3, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-1000488?
The severity of CVE-2017-1000488 is medium with a CVSS score of 6.1.
2
How does CVE-2017-1000488 affect Mautic?
CVE-2017-1000488 affects Mautic versions 2.1.0 to 2.11.0.
3
What is the impact of CVE-2017-1000488?
CVE-2017-1000488 allows an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
4
How can I fix CVE-2017-1000488?
To fix CVE-2017-1000488, you should upgrade to Mautic version 2.12.0 or later.
5
Where can I find more information about CVE-2017-1000488?
You can find more information about CVE-2017-1000488 at the following link: [https://github.com/mautic/mautic/releases/tag/2.12.0](https://github.com/mautic/mautic/releases/tag/2.12.0)