CVE-2020-35124

Packagist/mautic/core CVE-2020-35124: critical

XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic

Action: Upgrade mautic/core to 2.16.5 or later.

composer require mautic/core:3.2.4

composer require mautic/core:2.16.5

Affected

Fixed versions

Sources

• osv: GHSA-39wj-j3jc-858m
• https://github.com/mautic/mautic/security/advisories/GHSA-39wj-j3jc-858m
• https://nvd.nist.gov/vuln/detail/CVE-2020-35124
• https://github.com/mautic/mautic/commit/20c5dc39b62164f6922ce53ea42cbb4ccec64e57
• https://forum.mautic.org/c/announcements/16
• https://github.com/FriendsOfPHP/security-advisories/blob/master/mautic/core/CVE-2020-35124.yaml
• https://packagist.org/packages/mautic/core
• https://www.horizon3.ai/disclosures/mautic-unauth-xss-to-rce
• https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

CVE-2020-35124 · published 2021-01-19T20:43:56Z · modified 2026-07-08T06:00:55.187626721Z · JSON