A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).
References
Link | Resource |
---|---|
https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
https://github.com/mautic/mautic/security/advisories/GHSA-42q7-95j7-w62m | Patch Third Party Advisory |
https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce | Exploit Technical Description Third Party Advisory |
https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4 | Release Notes Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-02-09T21:39:33
Updated: 2021-02-09T21:39:33
Reserved: 2020-12-11T00:00:00
Link: CVE-2020-35125
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-02-09T22:15:13.620
Modified: 2021-02-16T15:56:31.220
Link: CVE-2020-35125
JSON object: View
Redhat Information
No data.
CWE