Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-47050

CVE-2024-47050: Mautic vulnerable to XSS in contact/company tracking (no authentication)

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-47050
GHSA ID
GHSA-73gr-32wg-qhh7
EPSS Score
0.41919%
CWE
CWE-79
Published
9/18/2024
Updated
9/27/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
mautic/corecomposer>= 2.6.0, < 4.4.134.4.13
mautic/corecomposer>= 5.0.0-alpha, < 5.1.15.1.1
mautic/core-libcomposer>= 2.6.0, < 4.4.134.4.13
mautic/core-libcomposer>= 5.0.0-alpha, < 5.1.15.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized user input in URL/email formatting functions. The patch introduced InputHelper::clean() and InputHelper::url() to sanitize values before HTML embedding. The pre-patch code directly interpolated $val into href attributes and link text without escaping (visible in FormatterHelper.php diffs). The added test cases (FormatterHelperTest.php) explicitly validate XSS prevention, confirming these were the vulnerable entry points. The tracking endpoint's handling of page_url parameters (shown in ReportControllerFunctionalTest.php) further demonstrates the attack vector through unescaped URL values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Summ*ry Prior to t*is p*t** **in* *ppli**, M*uti*'s tr**kin* w*s vuln*r**l* to *ross-Sit* S*riptin* t*rou** t** P*** URL v*ri**l*. ## P*t***s Pl**s* up**t* to *.*.** or *.*.* or l*t*r. ## Work*roun*s Non* ## R***r*n**s *ttps://ow*sp.or*/www-p

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** us*r input in URL/*m*il *orm*ttin* *un*tions. T** p*t** intro*u*** Input**lp*r::*l**n() *n* Input**lp*r::url() to s*nitiz* v*lu*s ***or* *TML *m****in*. T** pr*-p*t** *o** *ir**tly int*rpol*t** $v*l into *r**