CVE Feed

    Dashboard / CVE / CVE-2021-27911

    CVE-2021-27911

    Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc.

    Published:Aug 30, 2021
    Last Modified:Nov 21, 2024
    EPS:Aug 30, 2021
    EPSS Score:0.00352
    CVSS Score:8.3

    Affected Products

    Vendor
    Acquia
    Product
    Mautic

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-3105 (CVSS 7.6) — SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a…
    CVE-2024-47055 (CVSS 4.3) — SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality…
    CVE-2024-47051 (CVSS 9.1) — This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These v…
    CVE-2024-47053 (CVSS 7.7) — This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. T…
    CVE-2022-25773 (CVSS 4.3) — This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di…
    CVE-2022-25770 (CVSS 7.8) — Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre…
    CVE-2024-47059 (CVSS 4.3) — When logging in with the correct username and incorrect weak password, the user receives the notification, tha…
    CVE-2021-27917 (CVSS 7.3) — Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.…
    CVE-2024-47050 (CVSS 5.4) — Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U…
    CVE-2024-47058 (CVSS 2.9) — With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High