{"id":"CVE-2022-25772","aliases":["EUVD-2022-4785","GHSA-pjpc-87mp-4332"],"status":"published","title":"Cross-site Scripting vulnerability in Mautic's tracking pixel functionality","description":"A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.63036,"percentile":0.99208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-05-25T22:36:33Z","modified":"2026-10-28T02:31:15Z","fixes":[{"ecosystem":"Packagist","package":"mautic/core","fixed_in":["4.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"mautic/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"mautic/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0"}]}],"versions":["1.0.0","1.0.0-beta","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-rc1","1.0.0-rc2","1.0.0-rc3","1.0.0-rc4","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.0-beta1","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.1","1.4.0","1.4.1","2.0.0","2.0.1","2.1.0","2.1.1","2.10.0","2.10.0-beta","2.10.1","2.11.0","2.11.0-beta","2.12.0","2.12.0-beta","2.12.1","2.12.1-beta","2.12.2","2.12.2-beta","2.13.0","2.13.0-beta","2.13.1","2.14.0","2.14.0-beta","2.14.1","2.14.1-beta","2.14.2","2.14.2-beta","2.15.0","2.15.0-beta","2.15.1","2.15.1-beta","2.15.2","2.15.2-beta","2.15.3","2.15.3-beta","2.16.0","2.16.0-beta","2.16.1","2.16.1-beta","2.16.2","2.16.2-beta","2.16.3","2.16.3-beta","2.16.4","2.16.5","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.9.0","2.9.0-beta","2.9.1","2.9.2","3.0.0","3.0.0-alpha","3.0.0-beta","3.0.0-beta2","3.0.1","3.0.2","3.0.2-rc","3.1.0","3.1.0-rc","3.1.1","3.1.1-rc","3.1.2","3.1.2-rc","3.2.0","3.2.0-rc","3.2.1","3.2.2","3.2.2-rc","3.2.3","3.2.4","3.2.5","3.2.5-rc","3.3.0","3.3.0-rc","3.3.1","3.3.2","3.3.2-rc","3.3.3","3.3.3-rc","3.3.4","3.3.5","4.0.0","4.0.0-alpha1","4.0.0-beta","4.0.0-rc","4.0.1","4.0.2","4.1.0","4.1.1","4.1.2","4.2.0","4.2.0-rc","4.2.0-rc1","4.2.1","4.2.2","4.3.0-beta","4.3.0-rc"]}],"products":[{"vendor":"acquia","product":"mautic"},{"vendor":"mautic","product":"mautic"}],"references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-pjpc-87mp-4332","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00847.html","tags":["x_transferred","advisory","web"]},{"url":"https://github.com/mautic/mautic/commit/462eb596027fd949efbf9ac5cb2b376805e9d246","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25772","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pjpc-87mp-4332"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25772.json","tags":["advisory"]},{"url":"https://github.com/mautic/mautic","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25772","description":"A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript","status":"published","published":"2022-06-20T00:00:00Z","modified":"2024-08-03T04:49:44.197Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-4785","description":"A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript","status":"published","published":"2022-06-20T00:00:00Z","modified":"2024-08-03T04:49:44Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-03T03:25:45.890215Z"}],"ghsa":[{"id":"GHSA-pjpc-87mp-4332","title":"Cross-site Scripting vulnerability in Mautic's tracking pixel functionality","description":"### Impact\n\nMautic allows you to track open rates by using tracking pixels. \nThe tracking information is stored together with extra metadata of the tracking request.\n\nThe output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation.\n\n### Patches\n\nPlease upgrade to 4.3.0\n\n### Workarounds\nNone.\n\n### References\n* Internally tracked under MST-38\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)\n","status":"published","published":"2022-05-25T22:36:33Z","modified":"2023-05-10T00:37:04Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2022-25772","description":"A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript","status":"published","published":"2022-06-20T13:15:07.973Z","modified":"2026-06-17T04:34:15.083Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"CVE-2022-25772","description":"A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript","status":"published","published":"2022-06-20T00:00:00Z","modified":"2026-10-28T02:31:15.05604881Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-pjpc-87mp-4332","title":"Cross-site Scripting vulnerability in Mautic's tracking pixel functionality","description":"### Impact\n\nMautic allows you to track open rates by using tracking pixels. \nThe tracking information is stored together with extra metadata of the tracking request.\n\nThe output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation.\n\n### Patches\n\nPlease upgrade to 4.3.0\n\n### Workarounds\nNone.\n\n### References\n* Internally tracked under MST-38\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)\n","status":"published","published":"2022-05-25T22:36:33Z","modified":"2026-07-08T06:27:57.011563393Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}