XSS vulnerability in company name field in Mautic

2021-01-1921:16:26

Google

osv.dev

0.001 Low

EPSS

Percentile

33.8%

JSON

Impact

Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company’s name that can result in denial of service and execution of javascript code.

Patches

Update to 2.14.0 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

CPENameOperatorVersion
mautic/coreeq2.12.1
mautic/coreeq2.5.1
mautic/coreeq2.14.0-beta
mautic/coreeq1.3.1
mautic/coreeq2.13.1
mautic/coreeq1.0.0-beta3
mautic/coreeq2.11.0
mautic/coreeq1.4.1
mautic/coreeq1.1.0
mautic/coreeq1.2.0

Name	Operator	Version
mautic/core	eq	2.12.1
mautic/core	eq	2.5.1
mautic/core	eq	2.14.0-beta
mautic/core	eq	1.3.1
mautic/core	eq	2.13.1
mautic/core	eq	1.0.0-beta3
mautic/core	eq	2.11.0
mautic/core	eq	1.4.1
mautic/core	eq	1.1.0
mautic/core	eq	1.2.0