What is GHSA-qjhr-c23f-w76q?

GHSA-qjhr-c23f-w76q is a security advisory published by GitHub Security Advisories with Medium severity. Inline JS XSS vulnerability in Mautic

Which CVE IDs does GHSA-qjhr-c23f-w76q cover?

GHSA-qjhr-c23f-w76q covers the following CVE IDs: CVE-2017-1000488. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qjhr-c23f-w76q?

GHSA-qjhr-c23f-w76q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-qjhr-c23f-w76q?

GHSA-qjhr-c23f-w76q affects 1 product, including: composer/mautic/core:\u003e= 2.1.0, \u003c 2.12.0.

GHSA-qjhr-c23f-w76qMediumCVSS 6.1

Inline JS XSS vulnerability in Mautic

Vendor

GitHub Security Advisories

Published

January 19, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2017-1000488 →

📋 Description

Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

Patches

Upgrade to 2.12.0 or later.

Workarounds

None

References

https://github.com/mautic/mautic/releases/tag/2.12.0

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

🎯 Affected products1

composer/mautic/core:>= 2.1.0, < 2.12.0

🔗 References (5)

https://github.com/mautic/mautic/security/advisories/GHSA-qjhr-c23f-w76q
https://nvd.nist.gov/vuln/detail/CVE-2017-1000488
https://github.com/mautic/mautic/commit/bda60c0eefbd19c759589e975e63ab1d201c1b8e
https://github.com/mautic/mautic/releases/tag/2.12.0
https://github.com/advisories/GHSA-qjhr-c23f-w76q