This CVE has been withdrawn by MITRE

MITRE marked CVE-2021-3142 as REJECTED on January 28, 2021. It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.

Reason given by MITRE

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

→ See the replacement:CVE-2020-35128

CVE-2021-3142

✕ Withdrawn — historical dataHIGHCVSS · not yet scored

—

XSS in Mautic

Impact

This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

Patches

Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

Workarounds

None

References

https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

For more information

If you have any questions or comments about this advisory: * Post in https://forum.mautic.org/c/support * Email us at [email protected]

CVSS v3: —
EchelonGraph score: Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB: —
EPSS %ILE: —
KEV: —Not applicable: this CVE ID was withdrawn

Published

January 29, 2021

Last Modified

January 29, 2021

Frequently asked(3)

What is CVE-2021-3142?

CVE-2021-3142 is a rejected CVE ID: its record was withdrawn on January 28, 2021 and no longer describes a vulnerability. Reason given: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Its record names CVE-2020-35128 as the replacement.

When was the CVE record for CVE-2021-3142 published?

The CVE record for CVE-2021-3142 was published on January 29, 2021. EchelonGraph's copy of the record carries a last-modified date of January 29, 2021; the record at its source may have been updated since.

How do I remediate CVE-2021-3142?

There is nothing to remediate under CVE-2021-3142: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability. Its record names CVE-2020-35128 as the replacement; act on that CVE instead.