CVE-2021-27908

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Mar 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-279096.1For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundl CVE-2021-279106.1Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The CVE-2021-279116.1Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when vie CVE-2021-279125.4Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title CVE-2021-279133.5The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomn CVE-2021-279144.8A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript CVE-2021-279159.0Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited CVE-2021-279168.1Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the CVE-2021-279175.4Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.CVE-2021-279187.5encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF CVE-2021-279195.5archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a CVE-2021-279217.5Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not