Lucene search

MauticCVE-2024-47058

HistorySep 18, 2024 - 9:15 p.m.

CVE-2024-47058

2024-09-1821:15:13

CWE-79

Mautic

web.nvd.nist.gov

cve-2024-47058

mautic

cross-site scripting

stored

html

vulnerability

sensitive information

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

3.4

Confidence

High

EPSS

Percentile

9.6%

JSON

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user’s current session.

Affected configurations

Nvd

Node

acquiamauticRange1.0.0–4.4.13

acquiamauticRange5.0.0–5.1.1

VendorProductVersionCPE
acquiamautic*cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
acquia	mautic	*	cpe:2.3:a:acquia:mautic::::::::

CNA Affected

[
  {
    "collectionURL": "https://packagist.org",
    "defaultStatus": "unaffected",
    "packageName": "mautic/core",
    "product": "Mautic",
    "repo": "https://github.com/mautic/mautic",
    "vendor": "Mautic",
    "versions": [
      {
        "lessThan": "< 4.4.13",
        "status": "affected",
        "version": ">= 1.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "< 5.1.1",
        "status": "affected",
        "version": ">= 5.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf