CVE-2020-35128 json
Mautic stored Cross-site Scripting (XSS)
published 2021-01-19 5 y ago modified 2026-06-17 4 mo ago also GHSA-98j2-3jv7-274m , EUVD-2022-3326
- cvss
- 9.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system.
Patch / fix
- packagist mautic/core 2.16.5, 3.2.4
- acquia mautic 2.16.5, 3.2.4
Exploit prediction
1.67% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- forum.mautic.org https://forum.mautic.org/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mautic/core | >=3.2.0, <3.2.4 >=2.0.0, <2.16.5 |
3.2.4 2.16.5 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
forum.mautic.org
/t/security-release-for-all-versions-of-mautic-prior-to-2-16-5-and-3-2-4/17786
web, exploit, vendor-advisory
-
forum.mautic.org
/c/announcements/16
web, vendor-advisory
-
labs.bishopfox.com
/advisories/mautic-version-3.2.2
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-35128
advisory
-
github.com
/mautic/mautic
package
Sources
- CVE List CVE-2020-35128
- GitHub Advisory GHSA-98j2-3jv7-274m
- NVD CVE-2020-35128
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.