Mautic Core Reflected Cross-Site Scripting Vulnerability in Lead Tagging

A reflected cross-site scripting vulnerability has been identified in Mautic Core versions 4.4.0 prior to 4.4.17, 5.0.0-alpha through 5.2.8, and 6.0.0-alpha through 6.0.5. This vulnerability allows attackers to execute arbitrary JavaScript in the context of another user's session. It occurs in the 'Tags' input field on the '/s/ajax?action=lead:addLeadTags' endpoint. Although the server sanitizes input before storing it, the payload is executed immediately upon reflection, enabling session hijacking and other malicious actions.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious JavaScript in the victim's browser, potentially leading to session hijacking, theft of sensitive data such as cookies, and unauthorized actions within the application.

Remediation

Users can upgrade to Mautic Core versions 4.4.17, 5.2.8, or 6.0.5 to address this vulnerability.