CVE Feed

    Dashboard / CVE / CVE-2021-27916

    CVE-2021-27916

    Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

    Published:Sep 17, 2024
    Last Modified:Oct 2, 2024
    EPS:Sep 17, 2024
    EPSS Score:0.00155
    CVSS Score:8.1

    Affected Products

    Vendor
    Acquia
    Product
    Mautic

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-3105 (CVSS 7.6) — SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a…
    CVE-2024-47055 (CVSS 4.3) — SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality…
    CVE-2024-47051 (CVSS 9.1) — This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These v…
    CVE-2024-47053 (CVSS 7.7) — This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. T…
    CVE-2022-25773 (CVSS 4.3) — This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di…
    CVE-2022-25770 (CVSS 7.8) — Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre…
    CVE-2024-47059 (CVSS 4.3) — When logging in with the correct username and incorrect weak password, the user receives the notification, tha…
    CVE-2021-27917 (CVSS 7.3) — Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.…
    CVE-2024-47050 (CVSS 5.4) — Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U…
    CVE-2024-47058 (CVSS 2.9) — With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High