CVE-2022-25774

MEDIUM4.8EPSS 0.06%

Mautic vulnerable to cross-site scripting in notifications via saving Dashboards

Published: 4/12/2024Modified: 9/18/2024

Description

### Impact Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards. ### Patches Update to Mautic 4.4.12. ### Workarounds None ### References - https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) If you have any questions or comments about this advisory: Email us at [[email protected]](mailto:[email protected])

Affected packages (1)

Packagist/mautic/corefrom 0, < 4.4.12

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-25774
PATCHhttps://github.com/mautic/mautic
WEBhttps://github.com/mautic/mautic/commit/e6d58de241b8c34126042dcb314d60eb5fc7b151
WEBhttps://github.com/mautic/mautic/security/advisories/GHSA-fhcx-f7jg-jx3f