CVE-2024-47058
Cross-site Scripting (XSS) - stored (edit form HTML field)
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS) - stored (edit form HTML field)
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
- Record
CVE-2024-47058- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2896
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
- Record
EUVD-2024-2896- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xv68-rrmw-9xwf
Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)
Impact
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Patches
Upgrade to 4.4.13 or 5.1.1 or later.
Workarounds
None
References
- https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting
If you have any questions or comments about this advisory:
Email us at [email protected]
- Record
GHSA-xv68-rrmw-9xwf- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
- Record
CVE-2024-47058- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site Scripting (XSS) - stored (edit form HTML field)
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
- Record
CVE-2024-47058- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-xv68-rrmw-9xwf
Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)
Impact
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Patches
Upgrade to 4.4.13 or 5.1.1 or later.
Workarounds
None
References
- https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting
If you have any questions or comments about this advisory:
Email us at [email protected]
- Record
GHSA-xv68-rrmw-9xwf- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mautic/corePackagist |
5.0.0-alpha up to 5.1.1 | 5.1.1 |
mautic/corePackagist |
1.0.0-beta up to 4.4.13 | 4.4.13 |
mautic/core-libPackagist |
5.0.0-alpha up to 5.1.1 | 5.1.1 |
mautic/core-libPackagist |
1.0.0-beta up to 4.4.13 | 4.4.13 |
mautic/corePackagist |
5.0.0-alpha up to 5.1.1, plus listed versions 5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1 Show 6 moreShow less5.0.0-rc25.0.15.0.25.0.35.0.45.1.0 |
5.1.1 |
mautic/corePackagist |
1.0.0-beta up to 4.4.13, plus listed versions 1.0.01.0.0-beta21.0.0-beta31.0.0-beta41.0.0-rc1 Show 45 moreShow less1.0.0-rc21.0.0-rc31.0.0-rc41.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.2.01.2.0-beta11.2.11.2.21.2.31.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.2 |
4.4.13 |
mautic/core-libPackagist |
5.0.0-alpha up to 5.1.1, plus listed versions 5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1 Show 6 moreShow less5.0.0-rc25.0.15.0.25.0.35.0.45.1.0 |
5.1.1 |
mautic/core-libPackagist |
1.0.0-beta up to 4.4.13, plus listed versions 4.0.04.0.0-alpha14.0.0-beta4.0.0-rc4.0.1 Show 27 moreShow less4.0.24.1.04.1.14.1.24.2.04.2.0-rc4.2.0-rc14.2.14.2.24.3.04.3.0-beta4.3.0-rc4.3.14.4.04.4.14.4.1-alpha4.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9 |
4.4.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47058 is a low vulnerability (CVSS 2.9) in Acquia Mautic, published September 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in mautic/core 5.1.1.
References
github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf
nvd.nist.gov/vuln/detail/CVE-2024-47058
packagist.org
Left out here: 99 versions. The JSON record has them.