CVE-2020-35124: XSS
Impact This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic.
This vulnerability was reported by Naveen Sunkavally at Horizon3.ai.
Patches Upgrade to 3.2.4 or 2.16.5.
Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff
Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff
Workarounds None
For more information If you have any questions or comments about this advisory: Post in https://forum.mautic.org/c/support Email us at security@mautic.org
Other sources
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35124?
CVE-2020-35124 is a highly critical cross-site scripting (XSS) vulnerability in the assets component of Mautic before version 3.2.4.
What is the severity of CVE-2020-35124?
The severity of CVE-2020-35124 is rated as critical with a score of 9.6.
How does CVE-2020-35124 impact Mautic?
CVE-2020-35124 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads in Mautic.
Which versions of Mautic are affected by CVE-2020-35124?
Mautic versions 2.0.0 to 2.16.5, and versions 3.0.0 to 3.2.0 are affected by CVE-2020-35124.
How can CVE-2020-35124 be fixed?
To fix CVE-2020-35124, upgrade Mautic to version 3.2.4 or later.