mautic/core (Packagist)
Advisories
108
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.1.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require mautic/core:^7.1.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-5hvg-w58j-545m Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector |
Medium EPSS 0.17% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-7h65-whp7-rgqf Mautic has Stored Cross-Site Scripting (XSS) in Projects Component |
High EPSS 0.21% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-2jrw-c95w-h43g Mautic has an Authorization Bypass in API v2 Endpoints |
High EPSS 0.20% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-6r9h-4h75-7q4x Mautic vulnerable to Path Traversal via Campaign Import |
Critical EPSS 0.58% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-9fx4-7cmj-47vg Mautic has Server-Side Template Injection (SSTI) in Theme Templates |
Critical EPSS 0.57% |
>= 1.3.0 | No fix yet |
| GHSA-9fx4-7cmj-47vg Mautic has Server-Side Template Injection (SSTI) in Theme Templates |
Critical EPSS 0.57% |
>= 5.0.0, < 5.2.11 | 5.2.11 |
| GHSA-9fx4-7cmj-47vg Mautic has Server-Side Template Injection (SSTI) in Theme Templates |
Critical EPSS 0.57% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-9fx4-7cmj-47vg Mautic has Server-Side Template Injection (SSTI) in Theme Templates |
Critical EPSS 0.57% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-jmv8-8j9j-rcpc Mautic Focus component Vulnerable to SSRF |
Medium EPSS 0.15% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-jmv8-8j9j-rcpc Mautic Focus component Vulnerable to SSRF |
Medium EPSS 0.15% |
>= 4.0.0, <= 4.4.13 | No fix yet |
| GHSA-jmv8-8j9j-rcpc Mautic Focus component Vulnerable to SSRF |
Medium EPSS 0.15% |
>= 5.0.0, < 5.2.11 | 5.2.11 |
| GHSA-jmv8-8j9j-rcpc Mautic Focus component Vulnerable to SSRF |
Medium EPSS 0.15% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-fcmw-wx57-9p75 Mautic has SQL Injection in API Contact Filtering |
High EPSS 0.22% |
>= 2.6.0, <= 4.4.13 | No fix yet |
| GHSA-fcmw-wx57-9p75 Mautic has SQL Injection in API Contact Filtering |
High EPSS 0.22% |
>= 5.0.0, < 5.2.11 | 5.2.11 |
| GHSA-fcmw-wx57-9p75 Mautic has SQL Injection in API Contact Filtering |
High EPSS 0.22% |
>= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-fcmw-wx57-9p75 Mautic has SQL Injection in API Contact Filtering |
High EPSS 0.22% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting |
High EPSS 0.33% |
>= 6.0.0-alpha, < 6.0.8 | 6.0.8 |
| GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting |
High EPSS 0.33% |
>= 2.10.0, < 5.2.10 | 5.2.10 |
| GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting |
High EPSS 0.33% |
>= 7.0.0-alpha, < 7.0.1 | 7.0.1 |
| GHSA-3fq7-c5m8-g86x Mautic user without privileged access to the Marketplace can install and uninstall composer packages |
Critical EPSS 0.25% |
>= 6.0.0, < 6.0.7 | 6.0.7 |
| GHSA-3fq7-c5m8-g86x Mautic user without privileged access to the Marketplace can install and uninstall composer packages |
Critical EPSS 0.25% |
>= 4.0.0, < 4.4.18 | 4.4.18 |
| GHSA-3fq7-c5m8-g86x Mautic user without privileged access to the Marketplace can install and uninstall composer packages |
Critical EPSS 0.25% |
>= 5.0.0, < 5.2.9 | 5.2.9 |
| GHSA-3ggv-qwcp-j6xg Mautic Vulnerable to User Enumeration via Response Timing |
Medium EPSS 0.28% |
>= 6.0.0-alpha, < 6.0.5 | 6.0.5 |
| GHSA-3ggv-qwcp-j6xg Mautic Vulnerable to User Enumeration via Response Timing |
Medium EPSS 0.28% |
>= 5.0.0-alpha, < 5.2.8 | 5.2.8 |
| GHSA-3ggv-qwcp-j6xg Mautic Vulnerable to User Enumeration via Response Timing |
Medium EPSS 0.28% |
>= 4.4.0, < 4.4.17 | 4.4.17 |
| GHSA-9v8p-m85m-f7mm Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add |
Medium EPSS 0.32% |
>= 5.0.0-alpha, < 5.2.8 | 5.2.8 |
| GHSA-9v8p-m85m-f7mm Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add |
Medium EPSS 0.32% |
>= 4.4.0, < 4.4.17 | 4.4.17 |
| GHSA-9v8p-m85m-f7mm Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add |
Medium EPSS 0.32% |
>= 6.0.0-alpha, < 6.0.5 | 6.0.5 |
| GHSA-438m-6mhw-hq5w Mautic vulnerable to secret data extraction via elfinder |
Medium EPSS 0.24% |
>= 6.0.0-alpha, < 6.0.5 | 6.0.5 |
| GHSA-438m-6mhw-hq5w Mautic vulnerable to secret data extraction via elfinder |
Medium EPSS 0.24% |
>= 5.0.0-alpha, < 5.2.8 | 5.2.8 |
| GHSA-438m-6mhw-hq5w Mautic vulnerable to secret data extraction via elfinder |
Medium EPSS 0.24% |
>= 4.4.0, < 4.4.17 | 4.4.17 |
| GHSA-hj6f-7hp7-xg69 Mautic vulnerable to SSRF via webhook function |
Low EPSS 0.30% |
>= 6.0.0-alpha, < 6.0.5 | 6.0.5 |
| GHSA-hj6f-7hp7-xg69 Mautic vulnerable to SSRF via webhook function |
Low EPSS 0.30% |
>= 5.0.0-alpha, < 5.2.8 | 5.2.8 |
| GHSA-hj6f-7hp7-xg69 Mautic vulnerable to SSRF via webhook function |
Low EPSS 0.30% |
>= 4.4.0, < 4.4.17 | 4.4.17 |
| GHSA-6vx9-9r2g-8373 Mautic has an Open Redirect vulnerability on user unlock path. |
Medium EPSS 0.25% |
>= 5.0.0-alpha, < 5.2.6 | 5.2.6 |
| GHSA-6vx9-9r2g-8373 Mautic has an Open Redirect vulnerability on user unlock path. |
Medium EPSS 0.25% |
>= 1.0.0, < 4.4.16 | 4.4.16 |
| GHSA-6vx9-9r2g-8373 Mautic has an Open Redirect vulnerability on user unlock path. |
Medium EPSS 0.25% |
>= 6.0.0-alpha, < 6.0.2 | 6.0.2 |
| GHSA-vph5-ghq3-q782 Mautic segment cloning doesn't have a proper permission check |
Medium EPSS 0.26% |
>= 6.0.0-alpha, < 6.0.2 | 6.0.2 |
| GHSA-vph5-ghq3-q782 Mautic segment cloning doesn't have a proper permission check |
Medium EPSS 0.26% |
>= 5.0.0-alpha, < 5.2.6 | 5.2.6 |
| GHSA-424x-cxvh-wq9p Mautic allows user name enumeration due to response time difference on password reset form |
Medium EPSS 0.33% |
>= 1.0.0, < 4.4.16 | 4.4.16 |
| GHSA-424x-cxvh-wq9p Mautic allows user name enumeration due to response time difference on password reset form |
Medium EPSS 0.33% |
>= 5.0.0-alpha, < 5.2.6 | 5.2.6 |
| GHSA-424x-cxvh-wq9p Mautic allows user name enumeration due to response time difference on password reset form |
Medium EPSS 0.33% |
>= 6.0.0-alpha, < 6.0.2 | 6.0.2 |
| GHSA-cqx4-9vqf-q3m8 Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure |
Medium EPSS 0.36% |
>= 5.0.0-alpha, < 5.2.6 | 5.2.6 |
| GHSA-cqx4-9vqf-q3m8 Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure |
Medium EPSS 0.36% |
>= 4.0.0, < 4.4.16 | 4.4.16 |
| GHSA-cqx4-9vqf-q3m8 Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure |
Medium EPSS 0.36% |
>= 6.0.0-alpha, < 6.0.2 | 6.0.2 |
| GHSA-h2wg-v8wg-jhxh Mautic does not shield .env files from web traffic |
Medium EPSS 0.12% |
>= 6.0.0-alpha, < 6.0.2 | 6.0.2 |
| GHSA-h2wg-v8wg-jhxh Mautic does not shield .env files from web traffic |
Medium EPSS 0.12% |
>= 4.4.0, < 4.4.16 | 4.4.16 |
| GHSA-h2wg-v8wg-jhxh Mautic does not shield .env files from web traffic |
Medium EPSS 0.12% |
>= 5.0.0-alpha, < 5.2.6 | 5.2.6 |
| GHSA-8xv7-g2q3-fqgc Mautic allows Improper Authorization in Reporting API |
High EPSS 0.74% |
>= 1.0.1, < 5.2.3 | 5.2.3 |
| GHSA-73gx-x7r9-77x2 Mautic allows Remote Code Execution and File Deletion in Asset Uploads |
Critical EPSS 1.80% |
< 5.2.3 | 5.2.3 |
| GHSA-4w2w-36vm-c8hf Mautic allows Relative Path Traversal in assets file upload |
Medium EPSS 0.59% |
< 5.2.3 | 5.2.3 |
| GHSA-5hc5-fxr9-5frc Duplicate Advisory: Mautic has insufficient authentication in upgrade flow Withdrawn |
High | >= 1.0.0-beta3, < 4.4.13 | 4.4.13 |
| GHSA-5hc5-fxr9-5frc Duplicate Advisory: Mautic has insufficient authentication in upgrade flow Withdrawn |
High | >= 5.0.0, < 5.1.1 | 5.1.1 |
| GHSA-8vff-35qm-qjvv Mautic allows users enumeration due to weak password login |
Medium EPSS 0.34% |
>= 5.1.0, < 5.1.1 | 5.1.1 |
| GHSA-qf6m-6m4g-rmrc Mautic has insufficient authentication in upgrade flow |
High EPSS 0.28% |
>= 1.0.0-beta3, < 4.4.13 | 4.4.13 |
| GHSA-qf6m-6m4g-rmrc Mautic has insufficient authentication in upgrade flow |
High EPSS 0.28% |
>= 5.0.0-alpha, < 5.1.1 | 5.1.1 |
| GHSA-xpc5-rr39-v8v2 Mautic has an XSS in contact tracking and page hits report |
Medium EPSS 0.29% |
>= 5.0.0-alpha, < 5.1.1 | 5.1.1 |
| GHSA-xpc5-rr39-v8v2 Mautic has an XSS in contact tracking and page hits report |
Medium EPSS 0.29% |
>= 1.0.0-beta4, < 4.4.13 | 4.4.13 |
| GHSA-xv68-rrmw-9xwf Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) |
Medium EPSS 0.21% |
>= 5.0.0-alpha, < 5.1.1 | 5.1.1 |
| GHSA-xv68-rrmw-9xwf Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) |
Medium EPSS 0.21% |
>= 1.0.0-beta, < 4.4.13 | 4.4.13 |
| GHSA-73gr-32wg-qhh7 Mautic vulnerable to XSS in contact/company tracking (no authentication) |
Medium EPSS 0.31% |
>= 2.6.0, < 4.4.13 | 4.4.13 |
| GHSA-73gr-32wg-qhh7 Mautic vulnerable to XSS in contact/company tracking (no authentication) |
Medium EPSS 0.31% |
>= 5.0.0-alpha, < 5.1.1 | 5.1.1 |
| GHSA-x3jx-5w6m-q2fc Mautic vulnerable to Improper Access Control in UI upgrade process |
Medium EPSS 0.29% |
>= 5.0.0-alpha, < 5.1.1 | 5.1.1 |
| GHSA-x3jx-5w6m-q2fc Mautic vulnerable to Improper Access Control in UI upgrade process |
Medium EPSS 0.29% |
>= 1.1.3, < 4.4.13 | 4.4.13 |
| GHSA-42q7-95j7-w62m Mautic is vulnerable to XSS vulnerability |
Critical EPSS 2.69% |
< 2.16.5 | 2.16.5 |
| GHSA-42q7-95j7-w62m Mautic is vulnerable to XSS vulnerability |
Critical EPSS 2.69% |
>= 3.0.0, < 3.2.4 | 3.2.4 |
| GHSA-mgv8-w49f-822w Mautic: MST-48 Server-Side Request Forgery in Asset section |
Medium EPSS 0.45% |
>= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
| GHSA-mgv8-w49f-822w Mautic: MST-48 Server-Side Request Forgery in Asset section |
Medium EPSS 0.45% |
>= 1.0.0-beta4, < 4.4.12 | 4.4.12 |
| GHSA-qjx3-2g35-6hv8 Mautic Sensitive Data Exposure due to inadequate user permission settings |
Medium EPSS 0.40% |
>= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
| GHSA-qjx3-2g35-6hv8 Mautic Sensitive Data Exposure due to inadequate user permission settings |
Medium EPSS 0.40% |
>= 1.0.2, < 4.4.12 | 4.4.12 |
| GHSA-jj6w-2cqg-7p94 Mautic SQL Injection in dynamic Reports |
High EPSS 0.59% |
>= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
| GHSA-jj6w-2cqg-7p94 Mautic SQL Injection in dynamic Reports |
High EPSS 0.59% |
>= 2.14.1, < 4.4.12 | 4.4.12 |
| GHSA-9fcx-cv56-w58p Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder |
High EPSS 0.80% |
>= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
| GHSA-9fcx-cv56-w58p Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder |
High EPSS 0.80% |
>= 3.3.0, < 4.4.12 | 4.4.12 |
| GHSA-fhcx-f7jg-jx3f Mautic vulnerable to cross-site scripting in notifications via saving Dashboards |
Medium EPSS 0.40% |
< 4.4.12 | 4.4.12 |
| GHSA-2rc5-2755-v422 Mautic vulnerable to stored cross-site scripting in description field |
Critical EPSS 0.62% |
>= 1.0.0-beta2, < 4.4.12 | 4.4.12 |
| GHSA-pjpc-87mp-4332 Cross-site Scripting vulnerability in Mautic's tracking pixel functionality |
Critical EPSS 63.04% |
< 4.3.0 | 4.3.0 |
| GHSA-3px5-wjh3-9x6r Mautic stored Cross-site Scripting (XSS) |
Critical EPSS 1.02% |
< 3.2.4 | 3.2.4 |
| GHSA-98j2-3jv7-274m Mautic stored Cross-site Scripting (XSS) |
Critical EPSS 1.67% |
>= 3.2.0, < 3.2.4 | 3.2.4 |
| GHSA-98j2-3jv7-274m Mautic stored Cross-site Scripting (XSS) |
Critical EPSS 1.67% |
>= 2.0.0, < 2.16.5 | 2.16.5 |
| GHSA-358v-cqjc-2pcq Mautic Cross Site Scripting (XSS) vulnerability |
Medium EPSS 1.09% |
< 2.14.2 | 2.14.2 |
| GHSA-8255-qf34-44mp Sensitive Cookie Without HttpOnly and Secure Flag |
High EPSS 1.11% |
< 2.1.1 | 2.1.1 |
| GHSA-7vvh-xqq4-w777 Mautic Cross-Site Request Forgery (CSRF) |
High EPSS 0.76% |
No fix yet | |
| GHSA-mj6m-246h-9w56 Improper regex in htaccess file |
Critical EPSS 0.51% |
< 3.3.5 | 3.3.5 |
| GHSA-mj6m-246h-9w56 Improper regex in htaccess file |
Critical EPSS 0.51% |
>= 4.0.0, < 4.2.0 | 4.2.0 |
| GHSA-x7g2-wrrp-r6h3 Use of a Broken or Risky Cryptographic Algorithm |
Low EPSS 0.46% |
>= 4.0.0-alpha1, < 4.0.0 | 4.0.0 |
| GHSA-x7g2-wrrp-r6h3 Use of a Broken or Risky Cryptographic Algorithm |
Low EPSS 0.46% |
< 3.3.4 | 3.3.4 |
| GHSA-32hw-3pvh-vcvc XSS vulnerability on password reset page |
Medium EPSS 4.07% |
< 3.3.4 | 3.3.4 |
| GHSA-32hw-3pvh-vcvc XSS vulnerability on password reset page |
Medium EPSS 4.07% |
>= 4.0.0-alpha1, < 4.0.0 | 4.0.0 |
| GHSA-86pv-95mj-7w5f Stored XSS vulnerability on Bounce Management Callback |
High EPSS 0.70% |
< 3.3.4 | 3.3.4 |
| GHSA-86pv-95mj-7w5f Stored XSS vulnerability on Bounce Management Callback |
High EPSS 0.70% |
>= 4.0.0-alpha1, < 4.0.0 | 4.0.0 |
| GHSA-72hm-fx78-xwhc XSS vulnerability on contacts view |
High EPSS 0.64% |
< 3.3.4 | 3.3.4 |
| GHSA-72hm-fx78-xwhc XSS vulnerability on contacts view |
High EPSS 0.64% |
>= 4.0.0-alpha1, < 4.0.0 | 4.0.0 |
| GHSA-rh5w-82wh-jhr8 XSS vulnerability on asset view |
High EPSS 0.60% |
< 3.3.4 | 3.3.4 |
| GHSA-rh5w-82wh-jhr8 XSS vulnerability on asset view |
High EPSS 0.60% |
>= 4.0.0-alpha1, < 4.0.0 | 4.0.0 |
| GHSA-4hjq-422q-4vpx Mautic vulnerable to secret data exfiltration via symfony parameters |
Medium EPSS 0.34% |
< 3.3.2 | 3.3.2 |
| GHSA-p7v4-gm6j-cw9m XSS in Mautic |
High | >= 2.0.0, < 2.16.5 | 2.16.5 |
| GHSA-p7v4-gm6j-cw9m XSS in Mautic |
High | >= 3.0.0, < 3.2.4 | 3.2.4 |
| GHSA-29v9-2fpx-j5g9 CSV Injection vulnerability with exported contact lists in Mautic |
Critical EPSS 1.63% |
< 2.13.0 | 2.13.0 |
| GHSA-9hx7-rg7w-xm79 XSS vulnerability in company name field in Mautic |
Medium EPSS 0.83% |
< 2.14.0 | 2.14.0 |
| GHSA-qjhr-c23f-w76q Inline JS XSS vulnerability in Mautic |
Medium EPSS 0.84% |
>= 2.1.0, < 2.12.0 | 2.12.0 |
| GHSA-vfxj-qg93-7wwc Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID |
High EPSS 1.14% |
< 2.13.0 | 2.13.0 |
| GHSA-6x98-fx9j-7c78 Disabled users able to log in with third party SSO plugin |
High EPSS 1.12% |
>= 2.0.0, < 2.12.0 | 2.12.0 |
| GHSA-5w74-jx7m-x6hv XSS vulnerability in theme config file in Mautic |
Medium EPSS 0.81% |
< 2.13.0 | 2.13.0 |
| GHSA-xcf7-cj8q-pcjm XSS vulnerability in Author URL of themes in Mautic |
Medium EPSS 0.91% |
>= 2.13.1, < 2.14.0 | 2.14.0 |
| GHSA-qpgw-2c72-4c89 Mautic users able to download any files from server using filemanager |
Medium EPSS 1.40% |
>= 1.0.0, < 2.12.0 | 2.12.0 |
| GHSA-39wj-j3jc-858m XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic |
Critical EPSS 2.43% |
>= 2.0.0, < 2.16.5 | 2.16.5 |
| GHSA-39wj-j3jc-858m XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic |
Critical EPSS 2.43% |
>= 3.0.0, < 3.2.4 | 3.2.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor