CVE-2018-8092: CSV Injection vulnerability with exported contact lists in Mautic
Impact Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSVInjection.
Patches Update to 2.13.0 or later.
Workarounds None.
For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Other sources
CSV Injection vulnerability with exported contact lists in Mautic
— Packagist
Mautic before 2.13.0 allows CSV injection.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 2.13.0 - Upgrade
Upgrade
Mauticto a version that resolves this vulnerability.Fixed in 2.13.0
Event History
Frequently Asked Questions
What is the vulnerability ID for Mautic?
The vulnerability ID for Mautic is CVE-2018-8092.
What is the title of the vulnerability?
The title of the vulnerability is 'Mautic before 2.13.0 allows CSV injection.'
What is the severity of CVE-2018-8092?
The severity of CVE-2018-8092 is critical (9.8).
What is CSV injection?
CSV injection is a technique where specially crafted data in a CSV file can be executed as code, potentially leading to unauthorized access or data disclosure.
How can I fix the Mautic vulnerability?
To fix the Mautic vulnerability, you should update to version 2.13.0 or newer, which includes a patch for the CSV injection vulnerability.