CVE-2024-47050

Description

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Reserved 2024-09-17 | Published 2024-09-18 | Updated 2024-09-19 | Assigner Mautic

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

>= 2.6.0 before < 4.4.13
affected

> 5.0.0 before < 5.1.1
affected

Credits

Mqrtin reporter

Patryk Gruszka remediation developer

Lenon Leite remediation reviewer

John Linhart remediation reviewer

References

github.com/...mautic/security/advisories/GHSA-73gr-32wg-qhh7

cve.org (CVE-2024-47050)

nvd.nist.gov (CVE-2024-47050)

Download JSON