CSV Injection vulnerability with exported contact lists in Mautic

2021-01-1921:16:29

Google

osv.dev

0.003 Low

EPSS

Percentile

68.4%

JSON

Impact

Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSV_Injection.

Patches

Update to 2.13.0 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

CPENameOperatorVersion
mautic/coreeq2.12.1
mautic/coreeq2.5.1
mautic/coreeq1.3.1
mautic/coreeq1.0.0-beta3
mautic/coreeq2.11.0
mautic/coreeq1.4.1
mautic/coreeq1.1.0
mautic/coreeq1.2.0
mautic/coreeq2.3.0
mautic/coreeq1.0.0-beta2

Name	Operator	Version
mautic/core	eq	2.12.1
mautic/core	eq	2.5.1
mautic/core	eq	1.3.1
mautic/core	eq	1.0.0-beta3
mautic/core	eq	2.11.0
mautic/core	eq	1.4.1
mautic/core	eq	1.1.0
mautic/core	eq	1.2.0
mautic/core	eq	2.3.0
mautic/core	eq	1.0.0-beta2