प्लेटफ़ॉर्म
php
घटक
mautic/core
में ठीक किया गया
4.3.0
4.3.0
CVE-2022-25772 describes a critical Cross-Site Scripting (XSS) vulnerability present in Mautic Core versions up to and including 4.3.0-rc. This vulnerability arises from insufficient filtering of metadata associated with tracking pixels, allowing attackers to inject malicious scripts. Successful exploitation could lead to unauthorized access and control of user accounts. A patch is available in version 4.3.0.
The vulnerability lies in how Mautic handles tracking pixel metadata. Mautic uses tracking pixels to monitor email open rates, storing associated data. The flaw occurs because this metadata is not properly sanitized before being displayed, enabling an attacker to inject arbitrary JavaScript code. An attacker could craft a malicious tracking pixel request, embedding a script that executes in the context of a user's browser when they open an email tracked by Mautic. This could allow the attacker to steal session cookies, redirect users to phishing sites, or deface the Mautic instance. The potential impact is significant, ranging from individual account compromise to broader system-level attacks if the Mautic instance has administrative privileges.
CVE-2022-25772 was publicly disclosed on May 25, 2022. There is currently no indication of active exploitation in the wild, but the vulnerability's critical severity and ease of exploitation suggest it remains a significant risk. No public proof-of-concept (PoC) exploits have been widely released, but the vulnerability's nature makes it likely that such exploits will emerge. It is not listed on the CISA KEV catalog at the time of this writing.
Organizations utilizing Mautic Core for marketing automation, particularly those relying on email tracking features, are at risk. Specifically, those running older, unpatched versions of Mautic (≤4.3.0-rc) are highly vulnerable. Shared hosting environments where multiple Mautic instances share resources may also be at increased risk due to the potential for cross-site contamination.
• php: Examine Mautic Core code for instances where tracking pixel metadata is displayed without proper sanitization. Search for functions related to HTML output and ensure they are using appropriate escaping mechanisms. • generic web: Monitor Mautic instance access logs for unusual requests containing potentially malicious tracking pixel data. Look for patterns indicative of XSS attempts. • generic web: Use a web application scanner to identify potential XSS vulnerabilities in Mautic, specifically targeting areas related to tracking pixel functionality.
disclosure
एक्सप्लॉइट स्थिति
EPSS
2.07% (84% शतमक)
CVSS वेक्टर
The primary and recommended mitigation for CVE-2022-25772 is to immediately upgrade Mautic Core to version 4.3.0 or later. This version includes the necessary fixes to properly sanitize tracking pixel metadata and prevent XSS attacks. Unfortunately, there are no known workarounds for this vulnerability beyond upgrading. Ensure that backups are performed before initiating the upgrade process to facilitate rollback if necessary. After upgrading, confirm the fix by sending a test email with a tracking pixel and verifying that the metadata display does not allow for script execution.
Actualice Mautic a la versión 4.3.0 o superior. Esta versión corrige la vulnerabilidad XSS en el componente de seguimiento web. La actualización se puede realizar a través del panel de administración de Mautic o descargando la última versión del sitio web oficial.
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2022-25772 is a critical XSS vulnerability in Mautic Core versions up to 4.3.0-rc, allowing attackers to inject malicious scripts via tracking pixel metadata.
Yes, if you are running Mautic Core versions 4.3.0-rc or earlier, you are vulnerable to this XSS attack.
Upgrade Mautic Core to version 4.3.0 or later to patch the vulnerability. There are no known workarounds.
While there's no confirmed active exploitation, the vulnerability's severity and ease of exploitation make it a potential target.
Refer to the official Mautic security advisory at [[email protected]] for more information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।