CVE-2018-11200: XSS vulnerability in company name field in Mautic
Impact Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
Patches Update to 2.14.0 or later.
Workarounds None.
For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Other sources
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
XSS vulnerability in company name field in Mautic
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 2.11.0 - Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 2.14.0 - Upgrade
Upgrade
Mauticto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in Mautic 2.13.1?
The vulnerability ID for this issue in Mautic 2.13.1 is CVE-2018-11200.
What is the severity of CVE-2018-11200?
The severity of CVE-2018-11200 is medium with a CVSS score of 6.1.
How does the Stored XSS vulnerability occur in Mautic 2.13.1?
The Stored XSS vulnerability occurs via the company name field in Mautic 2.13.1.
Which software version is affected by CVE-2018-11200?
The software version affected by CVE-2018-11200 is Mautic 2.13.1.
How can I fix the Stored XSS vulnerability in Mautic 2.13.1?
To fix the Stored XSS vulnerability in Mautic 2.13.1, upgrade to version 2.14.0 or later.