Search for packages
| purl | pkg:composer/mautic/core@3.2.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-ghuh-z1uh-mbf5
Aliases: CVE-2021-27908 GHSA-4hjq-422q-4vpx |
Incorrect Permission Assignment for Critical Resource Secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1unf-fcpb-t7gr | Cross-site Scripting Mautic is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account. |
CVE-2020-35129
GHSA-3px5-wjh3-9x6r |
| VCID-9tjy-3czw-37as | Cross-site Scripting A cross-site scripting (XSS) vulnerability in the assets component of Mautic allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. |
CVE-2020-35124
GHSA-39wj-j3jc-858m |
| VCID-dh9y-k8zb-zkew | Cross-site Scripting A cross-site scripting (XSS) vulnerability in the forms component of Mautic allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept). |
CVE-2020-35125
GHSA-42q7-95j7-w62m |
| VCID-j624-5zx3-c7c8 | XSS in Mautic ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. |
CVE-2021-3142
GHSA-p7v4-gm6j-cw9m |
| VCID-p9jy-6mbb-ukad | Cross-site Scripting Mautic is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system. |
CVE-2020-35128
GHSA-98j2-3jv7-274m |