CVE-2020-35129: mautic Cross-site Scripting
Vulnerability summary
CVE-2020-35129 is a critical (CVSS 9.0) Cross-site Scripting vulnerability in mautic. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities.
Timeline
- 19-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.02%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 1.01% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mautic1 product
- mautic< 3.2.4
1 vendor · 1 product