cve-2021-27910
Vulnerability from cvelistv5
Published
2021-08-30 15:55
Modified
2024-09-17 01:25
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Summary
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.
References
security@mautic.orghttps://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5fPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5fPatch, Third Party Advisory
Impacted products
Vendor Product Version
Mautic Mautic Version: unspecified   < 3.3.4
Version: unspecified   < 4.0.0
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:33:16.394Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Mautic",
          "vendor": "Mautic",
          "versions": [
            {
              "lessThan": "3.3.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Fixed by Zdeno Kuzmany, Webmecanik"
        }
      ],
      "datePublic": "2021-08-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer/\u003cproduct / webhook\u003e/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-30T15:55:08",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f"
        }
      ],
      "source": {
        "defect": [
          "MST-17"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS vulnerability on Bounce Management Callback",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mautic.org",
          "DATE_PUBLIC": "2021-08-30T14:06:00.000Z",
          "ID": "CVE-2021-27910",
          "STATE": "PUBLIC",
          "TITLE": "Stored XSS vulnerability on Bounce Management Callback"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Mautic",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.3.4"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mautic"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Fixed by Zdeno Kuzmany, Webmecanik"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer/\u003cproduct / webhook\u003e/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f",
              "refsource": "MISC",
              "url": "https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f"
            }
          ]
        },
        "source": {
          "defect": [
            "MST-17"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2021-27910",
    "datePublished": "2021-08-30T15:55:08.436773Z",
    "dateReserved": "2021-03-02T00:00:00",
    "dateUpdated": "2024-09-17T01:25:50.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3.4\", \"matchCriteriaId\": \"EA7B8AF8-5929-4515-9EFF-9F589FA3FFDC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4B8FCED-A690-45D0-ACE1-871ADA2080F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"14D56FFE-E768-4502-BA7E-6B34BFE463B4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*\", \"matchCriteriaId\": \"C536B44B-C713-47D1-9EBD-E2D94CB0561E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \\\"error\\\" and \\\"error_related_to\\\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \\\"error\\\" and \\\"error_related_to\\\" parameters of the POST request (POST /mailer/\u003cproduct / webhook\u003e/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\"}, {\"lang\": \"es\", \"value\": \"Un saneamiento / filtrado insuficiente permite una inyecci\\u00f3n arbitraria de JavaScript en Mautic mediante la funci\\u00f3n bounce management callback. Los valores enviados en los par\\u00e1metros \\\"error\\\" y \\\"error_related_to\\\" de la petici\\u00f3n POST de la devoluci\\u00f3n de llamada de la administraci\\u00f3n de rebotes ser\\u00e1n almacenados de forma permanente y ser\\u00e1n ejecutados una vez que la p\\u00e1gina de detalles de un lead afectado sea abierta por un usuario de Mautic. Un atacante con acceso a la funci\\u00f3n de callback de administraci\\u00f3n de rebotes (identificada con el webhook de Mailjet, pero se supone que esto funcionar\\u00e1 uniformemente en todos los tipos de webhooks) puede inyectar c\\u00f3digo JavaScript arbitrario en los par\\u00e1metros \\\"error\\\" y \\\"error_related_to\\\" de la petici\\u00f3n POST (POST /mailer//callback). N\\u00f3tese que no se necesita autenticaci\\u00f3n para acceder a esta funci\\u00f3n. El c\\u00f3digo JavaScript es almacenado permanentemente en la aplicaci\\u00f3n web y es ejecutado cada vez que un usuario autenticado visualiza la p\\u00e1gina de detalles de un solo contacto / lead en Mautic. Esto significa que puede ser ejecutado un c\\u00f3digo arbitrario para, por ejemplo, robar o manipular informaci\\u00f3n.\"}]",
      "id": "CVE-2021-27910",
      "lastModified": "2024-11-21T05:58:46.740",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@mautic.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2021-08-30T16:15:07.293",
      "references": "[{\"url\": \"https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f\", \"source\": \"security@mautic.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security@mautic.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@mautic.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-27910\",\"sourceIdentifier\":\"security@mautic.org\",\"published\":\"2021-08-30T16:15:07.293\",\"lastModified\":\"2024-11-21T05:58:46.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \\\"error\\\" and \\\"error_related_to\\\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \\\"error\\\" and \\\"error_related_to\\\" parameters of the POST request (POST /mailer/\u003cproduct / webhook\u003e/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\"},{\"lang\":\"es\",\"value\":\"Un saneamiento / filtrado insuficiente permite una inyecci\u00f3n arbitraria de JavaScript en Mautic mediante la funci\u00f3n bounce management callback. Los valores enviados en los par\u00e1metros \\\"error\\\" y \\\"error_related_to\\\" de la petici\u00f3n POST de la devoluci\u00f3n de llamada de la administraci\u00f3n de rebotes ser\u00e1n almacenados de forma permanente y ser\u00e1n ejecutados una vez que la p\u00e1gina de detalles de un lead afectado sea abierta por un usuario de Mautic. Un atacante con acceso a la funci\u00f3n de callback de administraci\u00f3n de rebotes (identificada con el webhook de Mailjet, pero se supone que esto funcionar\u00e1 uniformemente en todos los tipos de webhooks) puede inyectar c\u00f3digo JavaScript arbitrario en los par\u00e1metros \\\"error\\\" y \\\"error_related_to\\\" de la petici\u00f3n POST (POST /mailer//callback). N\u00f3tese que no se necesita autenticaci\u00f3n para acceder a esta funci\u00f3n. El c\u00f3digo JavaScript es almacenado permanentemente en la aplicaci\u00f3n web y es ejecutado cada vez que un usuario autenticado visualiza la p\u00e1gina de detalles de un solo contacto / lead en Mautic. Esto significa que puede ser ejecutado un c\u00f3digo arbitrario para, por ejemplo, robar o manipular informaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3.4\",\"matchCriteriaId\":\"EA7B8AF8-5929-4515-9EFF-9F589FA3FFDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4B8FCED-A690-45D0-ACE1-871ADA2080F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"14D56FFE-E768-4502-BA7E-6B34BFE463B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"C536B44B-C713-47D1-9EBD-E2D94CB0561E\"}]}]}],\"references\":[{\"url\":\"https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f\",\"source\":\"security@mautic.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.