Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2020-35129: Mautic 3.2.3 and earlier: Stored Cross-Site Scripting in Social Monitoring
CVE-2020-35129 · published 5 years ago
Summary
Mautic versions 3.2.3 and earlier contain a security flaw in the Social Monitoring feature that could allow an attacker to harm other users, including administrators, by taking over their accounts. This could be done by loading malicious code on a user's page. You should update to version 3.2.4 or later to fix this issue.
What to do
- Update mautic core to version 3.2.4.
- Update mautic mautic to version 3.2.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | mautic | core |
< 3.2.4 Fix: upgrade to 3.2.4
|
| – | mautic | mautic |
< 3.2.4 cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:* |
Original advisory text
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker cou...
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.0
Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published19 Jan 2021
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta