CVE-2020-35129: XSS
First published: Tue Jan 19 2021(Updated: )
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mautic Mautic | <3.2.4 | |
| composer/mautic/core | <3.2.4 | 3.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-35129?
CVE-2020-35129 is a vulnerability in Mautic before version 3.2.4 that allows for stored XSS attacks, potentially enabling unauthorized access and control of user accounts.
How does CVE-2020-35129 affect Mautic?
CVE-2020-35129 affects Mautic versions before 3.2.4 and can be exploited through the Social Monitoring feature, allowing an attacker to execute malicious JavaScript code and potentially compromise user accounts, including administrator accounts.
What is the severity of CVE-2020-35129?
CVE-2020-35129 has a severity rating of 9 (critical), indicating a high risk of exploitation and significant impact on the affected system.
How can I fix CVE-2020-35129?
To fix CVE-2020-35129, it is recommended to update Mautic to version 3.2.4 or newer, which includes the necessary security patches to prevent the vulnerability.
Are there any additional references for CVE-2020-35129?
Additional references for CVE-2020-35129 can be found at the following links: [1] [2]
- collector/nvd-index
- agent/first-publish-date
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3px5-wjh3-9x6r
- alias/CVE-2020-35129
- agent/software-canonical-lookup
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/tags
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- vendor/mautic
- canonical/mautic mautic
- package-manager/composer