CRITICAL9.8

GHSA-29v9-2fpx-j5g9

CSV Injection vulnerability with exported contact lists in Mautic

Quick fix

GHSA-29v9-2fpx-j5g9 — mautic/core: upgrade to the fixed version with the command below.

composer require mautic/core:^2.13.0

Details

### Impact Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSV_Injection.

### Patches Update to 2.13.0 or later.

### Workarounds None.

### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mautic/core

Introduced in: 0Fixed in: 2.13.0

Fixcomposer require mautic/core:^2.13.0

References

https://github.com/mautic/mautic/security/advisories/GHSA-29v9-2fpx-j5g9[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2018-8092[ADVISORY]
https://github.com/mautic/mautic/commit/cbc49f0ac4cc7e3acc07f2a85c079b2f85225a6b[WEB]
https://github.com/mautic/mautic/releases/tag/2.13.0[WEB]