What is GHSA-fhcx-f7jg-jx3f?

GHSA-fhcx-f7jg-jx3f is a security advisory published by GitHub Security Advisories with Medium severity. Mautic vulnerable to cross-site scripting in notifications via saving Dashboards

Which CVE IDs does GHSA-fhcx-f7jg-jx3f cover?

GHSA-fhcx-f7jg-jx3f covers the following CVE IDs: CVE-2022-25774. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fhcx-f7jg-jx3f?

GHSA-fhcx-f7jg-jx3f has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-fhcx-f7jg-jx3f?

GHSA-fhcx-f7jg-jx3f affects 1 product, including: composer/mautic/core:\u003c 4.4.12.

GHSA-fhcx-f7jg-jx3fMediumCVSS 4.8

Mautic vulnerable to cross-site scripting in notifications via saving Dashboards

Vendor

GitHub Security Advisories

Published

April 12, 2024

Last Modified

September 18, 2024

🔗 CVE IDs covered (1)

CVE-2022-25774 →

📋 Description

Impact

Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic.

Users could inject malicious code into the notification when saving Dashboards.

Patches

Update to Mautic 4.4.12.

Workarounds

None

References

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)

If you have any questions or comments about this advisory:

Email us at [email protected]

🎯 Affected products1

composer/mautic/core:< 4.4.12

🔗 References (4)

https://github.com/mautic/mautic/security/advisories/GHSA-fhcx-f7jg-jx3f
https://github.com/mautic/mautic/commit/e6d58de241b8c34126042dcb314d60eb5fc7b151
https://nvd.nist.gov/vuln/detail/CVE-2022-25774
https://github.com/advisories/GHSA-fhcx-f7jg-jx3f