Stored XSS vulnerability on Bounce Management Callback
Impact
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.
An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function.
The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.
Patches
Upgrade to 3.3.4 or 4.0.0
Workarounds
No
References
https://github.com/mautic/mautic/releases/tag/3.3.4 https://github.com/mautic/mautic/releases/tag/4.0.0
For more information
If you have any questions or comments about this advisory:
- Email us at security@mautic.org
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | mautic/core | < 3.3.4, >= 4.0.0-alpha1, < 4.0.0 | 3.3.4, 4.0.0 |
Referencias
- https://github.com/mautic/mautic/security/advisories/GHSA-86pv-95mj-7w5f
- https://nvd.nist.gov/vuln/detail/CVE-2021-27910
- https://github.com/mautic/mautic/commit/e6a405975342f3cf86aa71927618d31d25135fa3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mautic/core/CVE-2021-27910.yaml
- https://github.com/mautic/mautic
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Composer
- Paquete
mautic/core- Publicada
- 01.09.2021
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-86pv-95mj-7w5f - CC BY 4.0
Historial de vulnerabilidades: mautic/core
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 57
- Primera → última
- 01.2021 07.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 9
- Alta 17
- Media 29
- Baja 2
Divulgaciones por año
- 2021: 16
- 2022: 7
- 2023: 0
- 2024: 13
- 2025: 13
- 2026: 8
-
Stored XSS vulnerability on Bounce Management Callback esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.