CVE-2021-27909: medium-severity vulnerability in Mautic
XSS vulnerability on password reset page
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 6.3epss 4.1%
For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Mautic · MauticRelated CVEs — Mautic
In the same product, most dangerous first.
CVE-2022-25772CRITICALCVE-2022-25772EPSS 63.0%CVE-2021-27916HIGHRelative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)EPSS 0.8%CVE-2021-27910HIGHStored XSS vulnerability on Bounce Management CallbackEPSS 0.7%CVE-2021-27911HIGHXSS vulnerability on contacts viewEPSS 0.6%CVE-2021-27915HIGHXSS Cross-site Scripting Stored (XSS) - Description fieldEPSS 0.6%CVE-2021-27912HIGHXSS vulnerability on asset viewEPSS 0.6%