CVE-2021-27909 - OpenCVE

For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Acquia	Mautic

Configuration 1 [-]

OR	cpe:2.3:a:acquia:mautic::::::::
	cpe:2.3:a:acquia:mautic:4.0.0:alpha1::::::
	cpe:2.3:a:acquia:mautic:4.0.0:beta::::::
	cpe:2.3:a:acquia:mautic:4.0.0:rc::::::

No data.

References

Link	Providers
https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc

History

No history.

MITRE

Status: PUBLISHED

Assigner: Mautic

Published: 2021-08-30T16:00:10.951539Z

Updated: 2024-09-16T20:52:58.796Z

Reserved: 2021-03-02T00:00:00

Link: CVE-2021-27909

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-08-30T16:15:07.230

Modified: 2021-09-10T14:00:49.630

Link: CVE-2021-27909

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Mautic", "vendor": "Mautic", "versions": [{"lessThan": "3.3.4", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "4.0.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Reported by https://github.com/ZhenwarX, Fixed by Mohit Aghera https://github.com/mohit-rocks"}], "datePublic": "2021-08-30T00:00:00", "descriptions": [{"lang": "en", "value": "For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, \"bundle,\" in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-30T16:00:10", "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc"}], "source": {"defect": ["MST-16"], "discovery": "EXTERNAL"}, "title": "XSS vulnerability on password reset page", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mautic.org", "DATE_PUBLIC": "2021-08-30T14:06:00.000Z", "ID": "CVE-2021-27909", "STATE": "PUBLIC", "TITLE": "XSS vulnerability on password reset page"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Mautic", "version": {"version_data": [{"version_affected": "<", "version_value": "3.3.4"}, {"version_affected": "<", "version_value": "4.0.0"}]}}]}, "vendor_name": "Mautic"}]}}, "credit": [{"lang": "eng", "value": "Reported by https://github.com/ZhenwarX, Fixed by Mohit Aghera https://github.com/mohit-rocks"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, \"bundle,\" in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc", "refsource": "MISC", "url": "https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc"}]}, "source": {"defect": ["MST-16"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:33:16.376Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc"}]}]}, "cveMetadata": {"assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "assignerShortName": "Mautic", "cveId": "CVE-2021-27909", "datePublished": "2021-08-30T16:00:10.951539Z", "dateReserved": "2021-03-02T00:00:00", "dateUpdated": "2024-09-16T20:52:58.796Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA7B8AF8-5929-4515-9EFF-9F589FA3FFDC", "versionEndExcluding": "3.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "A4B8FCED-A690-45D0-ACE1-871ADA2080F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:beta:*:*:*:*:*:*", "matchCriteriaId": "14D56FFE-E768-4502-BA7E-6B34BFE463B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:4.0.0:rc:*:*:*:*:*:*", "matchCriteriaId": "C536B44B-C713-47D1-9EBD-E2D94CB0561E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, \"bundle,\" in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized."}, {"lang": "es", "value": "Para Mautic versiones anteriores a 3.3.4/4.0.0, se presenta una vulnerabilidad de tipo XSS en la p\u00e1gina de restablecimiento de contrase\u00f1a de Mautic donde un par\u00e1metro vulnerable, \"bundle\", en la URL podr\u00eda permitir a un atacante ejecutar c\u00f3digo Javascript. El atacante tendr\u00eda que convencer o enga\u00f1ar al objetivo para que haga clic en una URL de restablecimiento de contrase\u00f1a con el par\u00e1metro vulnerable usado."}], "id": "CVE-2021-27909", "lastModified": "2021-09-10T14:00:49.630", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security@mautic.org", "type": "Secondary"}]}, "published": "2021-08-30T16:15:07.230", "references": [{"source": "security@mautic.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-32hw-3pvh-vcvc"}], "sourceIdentifier": "security@mautic.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@mautic.org", "type": "Secondary"}]}