PT-2021-11710

CVE-2020-35124

Published

2021-01-19

Updated

2021-02-09

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 2.16.5 Mautic versions prior to 3.2.4

Description: A cross-site scripting (XSS) issue in the assets component allows remote attackers to inject executable JavaScript through the Referer header of asset downloads. This could allow an attacker unauthorized administrator-level access to Mautic.

Recommendations: For versions prior to 2.16.5, upgrade to 2.16.5. For versions prior to 3.2.4, upgrade to 3.2.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2020-35124