PatchTheCVEmautic vulnerabilities
Recent CVEs affecting mautic products. 9 tracked.
mautic has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2021-01-19. Highest priority: CVE-2018-8092 (score 58/100).
- CVE-2020-35129 CRITICAL 9.0 UPGRADE Mautic before 3.2.4 is affected by stored XSS
- CVE-2018-8092 CRITICAL 9.8 UPGRADE Mautic before 2.13.0 allows CSV injection.
- CVE-2018-8071 MEDIUM 6.1 UPGRADE Mautic before v2.13.0 has stored XSS via a theme config file.
- CVE-2018-10189 HIGH 7.5 UPGRADE An issue was discovered in Mautic 1.x and 2.x before 2.13.0
- CVE-2017-1000506 MEDIUM 6.1 UPGRADE Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that c
- CVE-2017-1000490 MEDIUM 6.5 DOWNGRADE DOWNGRADE Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged i
- CVE-2017-1000489 HIGH 8.1 DOWNGRADE DOWNGRADE Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using em
- CVE-2017-1000488 MEDIUM 6.1 DOWNGRADE DOWNGRADE Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic lan
- CVE-2017-1000046 HIGH 7.5 UPGRADE Mautic 2.6.1 and earlier fails to set flags on session cookies
FAQ
How do I fix mautic vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mautic being exploited right now?
None of the tracked mautic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mautic CVE should I patch first?
CVE-2018-8092 currently ranks highest (58/100): Mautic before 2.13.0 allows CSV injection..