Vulnerabilities > Acquia > Mautic > 1.2.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-18 | CVE-2022-25770 | Missing Authentication for Critical Function vulnerability in Acquia Mautic Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable. | 7.5 |
| 2024-09-18 | CVE-2022-25768 | Missing Authorization vulnerability in Acquia Mautic The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. | 6.5 |
| 2024-09-18 | CVE-2022-25777 | Server-Side Request Forgery (SSRF) vulnerability in Acquia Mautic Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability. | 6.5 |
| 2024-09-18 | CVE-2022-25774 | Cross-site Scripting vulnerability in Acquia Mautic Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards. | 5.4 |
| 2024-09-18 | CVE-2022-25776 | Incorrect Default Permissions vulnerability in Acquia Mautic Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names. | 6.5 |
| 2024-09-17 | CVE-2021-27915 | Cross-site Scripting vulnerability in Acquia Mautic Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions. This could lead to the user having elevated access to the system. | 9.0 |
| 2022-06-20 | CVE-2022-25772 | Cross-site Scripting vulnerability in Acquia Mautic A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript | 6.1 |
| 2022-06-01 | CVE-2021-27914 | Cross-site Scripting vulnerability in Acquia Mautic A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript | 4.8 |
| 2021-08-30 | CVE-2021-27909 | Cross-site Scripting vulnerability in Acquia Mautic For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. | 6.1 |
| 2021-08-30 | CVE-2021-27910 | Cross-site Scripting vulnerability in Acquia Mautic Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. | 6.1 |