« Volver al listado

CVE-2021-27915

Estado: AnalizadaCrítica (9)—

Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions.

This could lead to the user having elevated access to the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Acquia — Mautic

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27915",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-27915",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-17T15:59:08.355119Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@mautic.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@mautic.org",
      "affectedData": [
        {
          "repo": "https://github.com/mautic/mautic",
          "vendor": "Mautic",
          "product": "Mautic",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0-beta2",
              "versionType": "semver",
              "lessThanOrEqual": "<= 4.4.11"
            }
          ],
          "packageName": "mautic/core-lib",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mautic:mautic:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mautic",
          "product": "mautic",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-beta2",
              "versionType": "semver",
              "lessThanOrEqual": "4.4.11"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-17T14:15:14.100",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-2rc5-2755-v422",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mautic.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@mautic.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions.\n\nThis could lead to the user having elevated access to the system."
    },
    {
      "lang": "es",
      "value": "Antes de la versión parcheada, existe una vulnerabilidad XSS en los campos de descripción dentro de la aplicación Mautic que podría ser explotada por un usuario registrado de Mautic con los permisos adecuados. Esto podría provocar que el usuario tenga acceso elevado al sistema."
    }
  ],
  "lastModified": "2026-06-17T03:45:36.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71754804-5279-4236-8CE2-434BC23B4A30",
              "versionEndExcluding": "4.4.12",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99718D48-5C19-41C5-84E1-52E95F012830"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B21EB9D-BFCD-4D58-BCA6-3AAE6B3B9041"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C1C106B-1B3D-427D-8147-5527E610F569"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E35B0F0-9BF1-45FA-8954-B8BFB7389C4D"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "213A9276-B9D1-4B4D-BBE9-FC42B6D63DE1"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F366E4D8-1515-4E5F-8551-4C8D9E00D0D9"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4234B41-F219-45B7-83A1-8F0F652F2A8B"
            },
            {
              "criteria": "cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA028F70-6020-47D6-BEC0-6FC0C7E18420"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mautic.org"
}