CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35128
https://notcve.org/view.php?id=CVE-2020-35128
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system. Mautic versiones anteriores a 3.2.4, está afectado por una vulnerabilidad de tipo XSS almacenado. • https://forum.mautic.org/c/announcements/16 https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786 https://labs.bishopfox.com/advisories/mautic-version-3.2.2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35129
https://notcve.org/view.php?id=CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account. Mautic versiones anteriores a 3.2.4, está afectado por una vulnerabilidad de tipo XSS almacenado. Un atacante con acceso a Social Monitoring, una funcionalidad de la aplicación, podría atacar a otros usuarios, incluyendo los administradores. • https://forum.mautic.org/c/announcements/16 https://labs.bishopfox.com/advisories/mautic-version-3.2.2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8071
https://notcve.org/view.php?id=CVE-2018-8071
Mautic before v2.13.0 has stored XSS via a theme config file. Mautic en versiones anteriores a la v2.13.0 tiene Cross-Site Scripting (XSS) persistente mediante un archivo de configuración de tema. • https://github.com/mautic/mautic/releases/tag/2.13.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8092
https://notcve.org/view.php?id=CVE-2018-8092
Mautic before 2.13.0 allows CSV injection. Mautic en versiones anteriores a la 2.13.0 permite la inyección CSV. • https://github.com/mautic/mautic/releases/tag/2.13.0 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-10189
https://notcve.org/view.php?id=CVE-2018-10189
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled. Se ha descubierto un problema en Mautic, en versiones 1.x y 2.x anteriores a la 2.13.0. • https://github.com/mautic/mautic/releases/tag/2.13.0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •