1. Home
  2. CVE Database
  3. CVE-2021-27911
HIGH · 8.3

CVE-2021-27911

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action dr...

Vulnerability Description

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc.

CVSS Score

8.3

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AcquiaMautic< 3.3.4

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-27911?

CVE-2021-27911 is a vulnerability with a CVSS score of 8.3 (HIGH). Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action dr...

How severe is CVE-2021-27911?

CVE-2021-27911 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-27911?

Check the references section above for vendor advisories and patch information. Affected products include: Acquia Mautic.