CVE-2020-35128: XSS
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-35128.
What is the severity level of CVE-2020-35128?
CVE-2020-35128 has a severity level of critical.
How does CVE-2020-35128 affect Mautic?
CVE-2020-35128 affects Mautic versions before 3.2.4.
What is the impact of CVE-2020-35128?
CVE-2020-35128 allows an attacker with permission to manage companies in Mautic to attack other users, including administrators, by loading an externally crafted JavaScript file and performing actions as the target user.
How can I fix CVE-2020-35128?
To fix CVE-2020-35128, it is recommended to update Mautic to version 3.2.4 or later.