CVE-2024-47058

Description

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.

Reserved 2024-09-17 | Published 2024-09-18 | Updated 2024-09-19 | Assigner Mautic

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

>= 1.0.0 before < 4.4.13
affected

>= 5.0.0 before < 5.1.1
affected

Credits

MatisAct reporter

Lenon Leite remediation developer

John Linhart remediation reviewer

Avikarsha Saha remediation reviewer

References

github.com/...mautic/security/advisories/GHSA-xv68-rrmw-9xwf

cve.org (CVE-2024-47058)

nvd.nist.gov (CVE-2024-47058)

Download JSON