CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27910 – Stored XSS vulnerability on Bounce Management Callback
https://notcve.org/view.php?id=CVE-2021-27910
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. • https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-27908
https://notcve.org/view.php?id=CVE-2021-27908
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application. En todas las versiones anteriores a Mautic 3.3.2, parámetros secretos, como las credenciales de la base de datos, podían ser expuestos públicamente por un usuario administrador autorizado aprovechando la sintaxis de los parámetros Symfony en cualquiera de los campos de texto libre en la configuración de Mautic que son usadas en las partes de la aplicación de cara al público • https://github.com/mautic/mautic/security/advisories/GHSA-4hjq-422q-4vpx • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35125
https://notcve.org/view.php?id=CVE-2020-35125
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept). Una vulnerabilidad de tipo cross-site scripting (XSS) en el componente forms de Mautic versiones anteriores a 3.2.4, permite a atacantes remotos inyectar JavaScript ejecutable por medio de mautic[return] (un método de ataque diferente al de CVE-2020-35124, pero también relacionado con el concepto Referer) • https://forum.mautic.org/c/announcements/16 https://github.com/mautic/mautic/security/advisories/GHSA-42q7-95j7-w62m https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35124
https://notcve.org/view.php?id=CVE-2020-35124
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. Una Vulnerabilidad de tipo Cross-site scripting (XSS) en el componente assets de Mautic versiones anteriores a 3.2.4, permite a atacantes remotos inyectar JavaScript ejecutable por medio del encabezado Referer de las descargas de activos • https://forum.mautic.org/c/announcements/16 https://github.com/mautic/mautic/security/advisories/GHSA-39wj-j3jc-858m https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35129
https://notcve.org/view.php?id=CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account. Mautic versiones anteriores a 3.2.4, está afectado por una vulnerabilidad de tipo XSS almacenado. Un atacante con acceso a Social Monitoring, una funcionalidad de la aplicación, podría atacar a otros usuarios, incluyendo los administradores. • https://forum.mautic.org/c/announcements/16 https://labs.bishopfox.com/advisories/mautic-version-3.2.2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •