XSS vulnerability in Author URL of themes in Mautic

中危 6.1CVE-2018-11198 · GHSA-xcf7-cj8q-pcjm · Published 06/09/2019 · updated 17/06/2026

要点

CVE-2018-11198 是影响 mautic/core, mautic (acquia) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.91%，高于 59.8% 的漏洞。
修复：升级到 2.14.0 或更高版本。

Package	Affected versions	Patched versions
mautic/core Packagist	`≥ 2.13.1, < 2.14.0`	`2.14.0`
mautic acquia	`= 2.13.1`	No fix yet

Description

Impact

An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

Patches

Update to 2.14 or later

Workarounds

None

References

https://github.com/mautic/mautic/releases/tag/2.14.0

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.

References

mautic/mautic security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2018-11198 · ADVISORY
mautic/mautic release · WEB
mautic/mautic release 2.14.0 · WEB

mautic/core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mautic/core

Packagist

≥ 2.13.1, < 2.14.0

2.14.0

mautic

acquia

= 2.13.1

No fix yet

Description

Impact

An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

Patches

Update to 2.14 or later

Workarounds

None

References

https://github.com/mautic/mautic/releases/tag/2.14.0

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.

mautic/core 的其他漏洞

查看全部 →