Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable Patches Please upgrade to 4.4.1 or 5.1.1 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 5.1.1 or 4.4.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report. Patches Please update to 4.4.13 or 5.1.1 or later. Workarounds None References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 5.1.1 or 4.4.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Patches Please update to 4.4.13 or 5.1.1 or later. Workarounds None References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 5.1.1 or 4.4.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session. Patches Upgrade to 4.4.13 or 5.1.1 or later. Workarounds None References - https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) - https://owasp.org/www-project-web-security-testing-guide/latest/4-WebApplicationSecurityTesting/07-InputValidationTesting/02-TestingforStoredCrossSiteScripting If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 5.1.1 or 4.4.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required. Patches Upgrade to 4.4.13 or 5.1.1 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 5.1.1 or 4.4.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.