CVE-2020-35129
Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
- Record
CVE-2020-35129- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
- Record
CVE-2020-35129- Updated
- 2026-11-02
EUVDEUVD-2022-2228 No score
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
- Record
EUVD-2022-2228- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3px5-wjh3-9x6r
Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
- Record
GHSA-3px5-wjh3-9x6r- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-3px5-wjh3-9x6r
Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
- Record
GHSA-3px5-wjh3-9x6r- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mautic/corePackagist |
before 3.2.4 | 3.2.4 |
mautic/corePackagist |
before 3.2.4, plus listed versions 1.0.01.0.0-beta1.0.0-beta21.0.0-beta31.0.0-beta4 Show 45 moreShow less1.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.2.01.2.0-beta11.2.11.2.21.2.31.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta |
3.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35129 is a critical vulnerability (CVSS 9.0) in Mautic, published January 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in mautic/core 3.2.4.
References
Left out here: 56 versions. The JSON record has them.