CVE-2020-35128: XSS
First published: Tue Jan 19 2021(Updated: )
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Acquia Mautic | >=2.0.0<2.16.5 | |
| Acquia Mautic | >=3.2.0<3.2.4 | |
| composer/mautic/core | >=2.0.0<2.16.5 | 2.16.5 |
| composer/mautic/core | >=3.2.0<3.2.4 | 3.2.4 |
| >=2.0.0<2.16.5 | ||
| >=3.2.0<3.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://forum.mautic.org/c/announcements/16
- https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
- https://labs.bishopfox.com/advisories/mautic-version-3.2.2
- https://nvd.nist.gov/vuln/detail/CVE-2020-35128
- https://github.com/advisories/GHSA-98j2-3jv7-274m (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-35128.
What is the severity level of CVE-2020-35128?
CVE-2020-35128 has a severity level of critical.
How does CVE-2020-35128 affect Mautic?
CVE-2020-35128 affects Mautic versions before 3.2.4.
What is the impact of CVE-2020-35128?
CVE-2020-35128 allows an attacker with permission to manage companies in Mautic to attack other users, including administrators, by loading an externally crafted JavaScript file and performing actions as the target user.
How can I fix CVE-2020-35128?
To fix CVE-2020-35128, it is recommended to update Mautic to version 3.2.4 or later.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-98j2-3jv7-274m
- alias/CVE-2020-35128
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/acquia
- canonical/acquia mautic
- version/acquia mautic/2.0.0
- version/acquia mautic/3.2.0
- package-manager/composer