CVE-2021-3142

XSS in Mautic

No scoreFix availableRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

What each source reports

CVE List No score

Record: CVE-2021-3142
Updated: 2026-11-02

EUVDEUVD-2021-0510 No score

Record: EUVD-2021-0510
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p7v4-gm6j-cw9m No score

XSS in Mautic

Impact

This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

Patches

Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

Workarounds

None

References

https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

For more information

If you have any questions or comments about this advisory:

Post in https://forum.mautic.org/c/support
Email us at [email protected]

Record: GHSA-p7v4-gm6j-cw9m
Weakness: CWE-79
Updated: 2026-11-02

NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35128. Reason: This candidate is a reservation duplicate of CVE-2020-35128. Notes: All CVE users should reference CVE-2020-35128 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record: CVE-2021-3142
Updated: 2026-11-02

OSVGHSA-p7v4-gm6j-cw9m No score

XSS in Mautic

Impact

This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

Patches

Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

Workarounds

None

References

https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

For more information

If you have any questions or comments about this advisory:

Post in https://forum.mautic.org/c/support
Email us at [email protected]

Record: GHSA-p7v4-gm6j-cw9m
Weakness: CWE-79
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`mautic/core` Packagist	3.0.0 up to 3.2.4	3.2.4
`mautic/core` Packagist	2.0.0 up to 2.16.5	2.16.5
`mautic/core` Packagist	3.0.0 up to 3.2.4, plus listed versions 3.0.13.0.23.0.2-rc3.1.03.1.0-rc Show 10 moreShow less 3.1.13.1.1-rc3.1.23.1.2-rc3.2.03.2.0-rc3.2.13.2.23.2.2-rc3.2.3	3.2.4
`mautic/core` Packagist	2.0.0 up to 2.16.5, plus listed versions 2.0.12.1.02.1.12.10.02.10.0-beta Show 45 moreShow less 2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta2.15.12.15.1-beta2.15.22.15.2-beta2.15.32.15.3-beta2.16.02.16.0-beta2.16.12.16.1-beta2.16.22.16.2-beta2.16.32.16.3-beta2.16.42.2.02.2.12.3.02.4.02.5.02.5.12.6.02.6.12.7.02.7.1	2.16.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3142 has been rejected by its source and should not be treated as a live vulnerability, published January 28, 2021. Fixed in mautic/core 3.2.4.

References

This page doesn't list everything

Left out here: 7 versions. The JSON record has them.