getformwork/formwork · Security
Formwork Cross-site Scripting (XSS) from Page title field
- GHSA ID
- GHSA-fvrh-wrpf-6q7h
- CVE ID
- CVE-2023-24230
- Severity
- medium
- Published
- Updated
- CVSS
- 4.8 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 4.8 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Description
Description
A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field.
Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field.
Patched versions
This vulnerability has been patched in Formwork 1.13.0.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')