Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
54 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Mautic before v2.13.0 has stored XSS via a theme config file. Patches Update to 2.13.0 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 2.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes. Patches Update to 2.14 or later Workarounds None References https://github.com/mautic/mautic/releases/tag/2.14.0 For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 2.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to. Patches Update to 2.12.0 or later. Workarounds None For more information If you have any questions or comments about this advisory: Email us at security@mautic.org
Recommended action: Upgrade to 2.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic. This vulnerability was reported by Naveen Sunkavally at Horizon3.ai. Patches Upgrade to 3.2.4 or 2.16.5. Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff Workarounds None For more information If you have any questions or comments about this advisory: Post in https://forum.mautic.org/c/support Email us at security@mautic.org
Recommended action: Upgrade to 3.2.4 or 2.16.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.