MEDIUM6.1

GHSA-qjhr-c23f-w76q

Inline JS XSS vulnerability in Mautic

Quick fix

GHSA-qjhr-c23f-w76q — mautic/core: upgrade to the fixed version with the command below.

composer require mautic/core:^2.12.0

Details

### Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

### Patches Upgrade to 2.12.0 or later.

### Workarounds None

### References https://github.com/mautic/mautic/releases/tag/2.12.0

### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mautic/core

Introduced in: 2.1.0Fixed in: 2.12.0

Fixcomposer require mautic/core:^2.12.0

References

https://github.com/mautic/mautic/security/advisories/GHSA-qjhr-c23f-w76q[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2017-1000488[ADVISORY]
https://github.com/mautic/mautic/commit/bda60c0eefbd19c759589e975e63ab1d201c1b8e[WEB]
https://github.com/mautic/mautic/releases/tag/2.12.0[WEB]