CVE-2020-35129: Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Other sources
Mautic stored Cross-site Scripting (XSS)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 3.2.4
Event History
Frequently Asked Questions
What is CVE-2020-35129?
CVE-2020-35129 is a vulnerability in Mautic before version 3.2.4 that allows for stored XSS attacks, potentially enabling unauthorized access and control of user accounts.
How does CVE-2020-35129 affect Mautic?
CVE-2020-35129 affects Mautic versions before 3.2.4 and can be exploited through the Social Monitoring feature, allowing an attacker to execute malicious JavaScript code and potentially compromise user accounts, including administrator accounts.
What is the severity of CVE-2020-35129?
CVE-2020-35129 has a severity rating of 9 (critical), indicating a high risk of exploitation and significant impact on the affected system.
How can I fix CVE-2020-35129?
To fix CVE-2020-35129, it is recommended to update Mautic to version 3.2.4 or newer, which includes the necessary security patches to prevent the vulnerability.
Are there any additional references for CVE-2020-35129?
Additional references for CVE-2020-35129 can be found at the following links: [1] [2]