---
id: 4092
title: "Mautic Version <=3.2.2 Advisory"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/mautic-version-3-2-2-advisory"
published_at: "2021-01-15T00:00:00Z"
tags: ["xss", "vulnerability", "advisory", "mautic", "cve-2020-35128", "cve-2020-35129"]
phying_url: "https://phying.com/item/4092"
lang: en
---

# Mautic Version <=3.2.2 Advisory

## Summary

Stored XSS in Mautic 3.2.2 and earlier (CVE-2020-35128, CVE-2020-35129): users with company or social-monitoring rights can inject JavaScript that runs for admins; fixed in 3.2.4.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2021-01-15T00:00:00Z
- **Original:** https://bishopfox.com/blog/mautic-version-3-2-2-advisory
- **Phying News:** https://phying.com/item/4092