CVE-2024-47058: Cross-site Scripting (XSS) - stored (edit form HTML field)
Impact With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Patches Upgrade to 4.4.13 or 5.1.1 or later.
Workarounds None
References - https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) - https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting
If you have any questions or comments about this advisory:
Email us at security@mautic.org
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47058?
CVE-2024-47058 is classified as a high severity vulnerability due to the potential for Cross-Site Scripting which could compromise user sessions.
How do I fix CVE-2024-47058?
To fix CVE-2024-47058, upgrade to Mautic version 4.4.13, 5.1.1, or later.
What types of attacks can CVE-2024-47058 facilitate?
CVE-2024-47058 can facilitate Cross-Site Scripting attacks, which may lead to the theft of sensitive information from user sessions.
Which Mautic versions are affected by CVE-2024-47058?
Mautic versions prior to 4.4.13 and 5.1.1 are affected by CVE-2024-47058.
Is there a workaround for CVE-2024-47058?
There are currently no known workarounds for CVE-2024-47058.