CVE-2020-35128

Vulnerability

Overview

CVE-2020-35128 is a stored cross-site scripting (XSS) vulnerability affecting Mautic, an open-source marketing automation platform, in versions prior to 3.2.4 [1][3]. The root cause lies in insufficient sanitization of user-supplied input in the company name field when managing companies. An authenticated attacker with permission to manage companies can inject malicious JavaScript payloads that are stored on the server and later executed in the browsers of other users who view the affected company data [4].

Exploitation

Prerequisites

Exploitation requires the attacker to have an authenticated session and be granted the 'manage companies' permission, a standard feature for certain Mautic user roles [4]. No additional privileges are needed beyond this access. The crafted payload can be introduced via the company name field during company creation or editing. Once stored, any user—including administrators—who loads the company list or detail page triggers the malicious script. The attacker could also load an externally crafted JavaScript file to bypass certain protections [3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to full account takeover: the attacker can change the victim's password, alter associated email addresses, or escalate privileges by creating a new administrator account [3][4]. Because administrators have elevated access, compromising an admin account could give the attacker full control over the Mautic instance.

Mitigation

The vulnerability is fixed in Mautic version 3.2.4, which was released on January 14, 2021 [4]. Users should upgrade immediately. No official workarounds were published, but administrators should review and restrict the 'manage companies' permission to only trusted users until upgrading is possible [1].