Headline
GHSA-fhcx-f7jg-jx3f: Mautic vulnerable to cross-site scripting in notifications via saving Dashboards
Impact
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic.
Users could inject malicious code into the notification when saving Dashboards.
Patches
Update to Mautic 4.4.12.
Workarounds
None
References
- https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
If you have any questions or comments about this advisory:
Email us at [email protected]
Package
composer mautic/core (Composer)
Affected versions
< 4.4.12
Patched versions
4.4.12
Description
Impact
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic.
Users could inject malicious code into the notification when saving Dashboards.
Patches
Update to Mautic 4.4.12.
Workarounds
None
References
- https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
If you have any questions or comments about this advisory:
Email us at [email protected]
References
- GHSA-fhcx-f7jg-jx3f
- mautic/mautic@e6d58de
RCheesley published to mautic/mautic
Apr 11, 2024
Published to the GitHub Advisory Database
Apr 12, 2024
Reviewed
Apr 12, 2024