Every CVE Search/ Get API key

CVE-2024-47050

XSS in contact/company tracking (no authentication)

5.4 MediumFix available

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Sep 19, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.4

XSS in contact/company tracking (no authentication)

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Record
CVE-2024-47050
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-2742 5.4

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Record
EUVD-2024-2742
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-73gr-32wg-qhh7 5.1

Mautic vulnerable to XSS in contact/company tracking (no authentication)

Summary

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Patches

Please update to 4.4.13 or 5.1.1 or later.

Workarounds

None

References

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting

If you have any questions or comments about this advisory: Email us at [email protected]

Record
GHSA-73gr-32wg-qhh7
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.4

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Record
CVE-2024-47050
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

XSS in contact/company tracking (no authentication)

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Record
CVE-2024-47050
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-73gr-32wg-qhh7 5.1

Mautic vulnerable to XSS in contact/company tracking (no authentication)

Summary

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

Patches

Please update to 4.4.13 or 5.1.1 or later.

Workarounds

None

References

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting

If you have any questions or comments about this advisory: Email us at [email protected]

Record
GHSA-73gr-32wg-qhh7
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mautic/core
Packagist
 2.6.0 up to 4.4.13
4.4.13
mautic/core
Packagist
 5.0.0-alpha up to 5.1.1
5.1.1
mautic/core-lib
Packagist
 2.6.0 up to 4.4.13
4.4.13
mautic/core-lib
Packagist
 5.0.0-alpha up to 5.1.1
5.1.1
mautic/core
Packagist
 2.6.0 up to 4.4.13, plus listed versions
2.10.02.10.0-beta2.10.12.11.02.11.0-beta
Show 45 moreShow less
2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta2.15.12.15.1-beta2.15.22.15.2-beta2.15.32.15.3-beta2.16.02.16.0-beta2.16.12.16.1-beta2.16.22.16.2-beta2.16.32.16.3-beta2.16.42.16.52.6.12.7.02.7.12.8.02.8.12.8.22.9.02.9.0-beta2.9.12.9.23.0.03.0.0-alpha
4.4.13
mautic/core
Packagist
 5.0.0-alpha up to 5.1.1, plus listed versions
5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1
Show 6 moreShow less
5.0.0-rc25.0.15.0.25.0.35.0.45.1.0
5.1.1
mautic/core-lib
Packagist
 2.6.0 up to 4.4.13, plus listed versions
4.0.04.0.0-alpha14.0.0-beta4.0.0-rc4.0.1
Show 27 moreShow less
4.0.24.1.04.1.14.1.24.2.04.2.0-rc4.2.0-rc14.2.14.2.24.3.04.3.0-beta4.3.0-rc4.3.14.4.04.4.14.4.1-alpha4.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9
4.4.13
mautic/core-lib
Packagist
 5.0.0-alpha up to 5.1.1, plus listed versions
5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1
Show 6 moreShow less
5.0.0-rc25.0.15.0.25.0.35.0.45.1.0
5.1.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47050 is a medium vulnerability (CVSS 5.4) in Acquia Mautic, published September 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in mautic/core 4.4.13.

References

This page doesn't list everything

Left out here: 61 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open