CVE-2021-27912

Cross-site Scripting in packagist/mautic/core

Identifier

CVE-2021-27912

Package Slug

packagist/mautic/core

Vulnerability

Cross-site Scripting

Description

Mautic is vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.

Affected Versions

All versions before 3.3.4, version 4.0.0

Solution

Upgrade to version 3.3.4 or above.

Last Modified

2021-09-06

source