Rcheesley

With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the `html` field. This could be used to steal sensitive information from the user's current session.

The issue affects logged in users of Mautic, making them vulnerable to an SQL injection vulnerability in the Reports bundle. This vulnerability allows an attacker to retrieve and alter sensitive data, including login information. Depending on the database permissions, the attacker may also be able to manipulate file systems.

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.

There is an XSS vulnerability in the description fields within the Mautic application, which could be exploited by a logged-in user with the appropriate permissions. This could lead to the user having elevated access to the system.

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: Insufficient sanitization/filtering allows for arbitrary JavaScript injection in Mautic using the bounce management callback function. An attacker can inject arbitrary JavaScript code into the `error` and `error related to` parameters of the POST request (POST /mailer/<product / webhook>/callback) without needing authentication. The injected JavaScript code is stored permanently and executed when an authenticated user views the details page of an affected lead, potentially allowing for information theft or tampering. Recommendations: Upgrade to version 3.3.4 or 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the bounce management callback function until the upgrade is applied. Avoid using the `error` and `error related to` parameters in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: The function `mt rand` is used to generate session tokens, which is cryptographically flawed due to its pseudorandom nature. An attacker can exploit this flaw to enumerate session tokens for accounts not under their control. This could allow an attacker to takeover accounts at random by enumerating and using access tokens. Recommendations: For Mautic versions prior to 3.3.4, update to version 3.3.4 or later. For Mautic versions prior to 4.0.0, update to version 4.0.0 or later. As a temporary workaround, consider disabling the use of `mt rand` for generating session tokens until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the `mt rand` function for security-critical operations until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: The issue allows for an inline JS XSS attack when viewing Mautic assets. This is achieved by utilizing inline JS in the title and adding a broken image URL as a remote asset. The attack can only be leveraged by an authenticated user with permission to create or edit assets. Recommendations: Upgrade to version 3.3.4 or 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to create or edit assets to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4/4.0.0 Description: The issue is related to an inline JS XSS attack that can be triggered through a contact's first or last name when viewing a contact's details page, clicking on the action drop down, and hovering over the Campaigns button. The contact's first and last name can be populated from various sources, including UI, API, 3rd party syncing, forms, etc. Recommendations: Upgrade to version 3.3.4 or 4.0.0 to resolve the issue. As a temporary workaround, consider restricting the input of contact first and last names to minimize the risk of exploitation. Avoid using potentially malicious input from different sources such as UI, API, 3rd party syncing, forms, etc. until the issue is resolved.