CVE-2020-35124: Cross-site Scripting

January 28, 2021 (updated February 5, 2021)

A cross-site scripting (XSS) vulnerability in the assets component of Mautic allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.

References

forum.mautic.org/c/announcements/16
nvd.nist.gov/vuln/detail/CVE-2020-35124

Code Behaviors & Features

Detect and mitigate CVE-2020-35124 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →