GHSA-3px5-wjh3-9x6r · Severity: critical · Ecosystem: composer — Mautic stored Cross-site Scripting (XSS)
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.
Conclusion & alert: CVE-2020-35129 is rated Moderate Risk (59.3/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 0.62%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-30 | 0.88% | 0.62% | -0.26% |
| 2 | 2025-03-29 | 0.62% | 0.88% | +0.26% |
| 3 | 2025-03-17 | — | 0.62% | — |
Full EPSS history (8 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.0 | 3.1 | CRITICAL |
|
2.3 | 6.0 | [email protected] |
| 6.0 | 2.0 | MEDIUM |
|
6.8 | 6.4 | [email protected] |
GHSA-3px5-wjh3-9x6r · Severity: critical · Ecosystem: composer — Mautic stored Cross-site Scripting (XSS)
| URL | Tags |
|---|---|
| https://forum.mautic.org/c/announcements/16 | Vendor Advisory |
| https://labs.bishopfox.com/advisories/mautic-version-3.2.2 | Third Party Advisory |