CVE-2021-27911

Cross-site Scripting in packagist/mautic/core

Identifier

CVE-2021-27911

Package Slug

packagist/mautic/core

Vulnerability

Cross-site Scripting

Description

Mautic is vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc.

Affected Versions

All versions before 3.3.4, all versions starting from 4.0.0-alpha1 before versions before 4.0.0

Solution

Upgrade to version 3.3.4, 4.0.0 or above.

Last Modified

2021-09-13

source