Lucene search

[email protected]NVD:CVE-2021-27912

HistoryAug 30, 2021 - 4:15 p.m.

CVE-2021-27912

2021-08-3016:15:07

CWE-79

[email protected]

web.nvd.nist.gov

mautic

xss

vulnerability

versions

authenticated user

remote asset

inline js

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.7%

JSON

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.

Affected configurations

Nvd

Node

acquiamauticRange<3.3.4

acquiamauticMatch4.0.0alpha1

acquiamauticMatch4.0.0beta

acquiamauticMatch4.0.0rc

VendorProductVersionCPE
acquiamautic*cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*
acquiamautic4.0.0cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*
acquiamautic4.0.0cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*
acquiamautic4.0.0cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*

Vendor	Product	Version	CPE
acquia	mautic	*	cpe:2.3:a:acquia:mautic::::::::
acquia	mautic	4.0.0	cpe:2.3:a:acquia:mautic:4.0.0:alpha1::::::
acquia	mautic	4.0.0	cpe:2.3:a:acquia:mautic:4.0.0:beta::::::
acquia	mautic	4.0.0	cpe:2.3:a:acquia:mautic:4.0.0:rc::::::