What is GHSA-73gr-32wg-qhh7?

GHSA-73gr-32wg-qhh7 is a security advisory published by GitHub Security Advisories with Medium severity. Mautic vulnerable to XSS in contact/company tracking (no authentication)

Which CVE IDs does GHSA-73gr-32wg-qhh7 cover?

GHSA-73gr-32wg-qhh7 covers the following CVE IDs: CVE-2024-47050. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-73gr-32wg-qhh7?

GHSA-73gr-32wg-qhh7 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-73gr-32wg-qhh7?

GHSA-73gr-32wg-qhh7 affects 4 products, including: composer/mautic/core:\u003e= 2.6.0, \u003c 4.4.13; composer/mautic/core:\u003e= 5.0.0-alpha, \u003c 5.1.1; composer/mautic/core-lib:\u003e= 2.6.0, \u003c 4.4.13; composer/mautic/core-lib:\u003e= 5.0.0-alpha, \u003c 5.1.1.

GHSA-73gr-32wg-qhh7MediumCVSS 5.4

Mautic vulnerable to XSS in contact/company tracking (no authentication)

Vendor

GitHub Security Advisories

Published

September 18, 2024

Last Modified

September 27, 2024

🔗 CVE IDs covered (1)

CVE-2024-47050 →

📋 Description

Summary

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Patches

Please update to 4.4.13 or 5.1.1 or later.

Workarounds

None

References

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting

If you have any questions or comments about this advisory: Email us at [email protected]

🎯 Affected products4

composer/mautic/core:>= 2.6.0, < 4.4.13
composer/mautic/core:>= 5.0.0-alpha, < 5.1.1
composer/mautic/core-lib:>= 2.6.0, < 4.4.13
composer/mautic/core-lib:>= 5.0.0-alpha, < 5.1.1