GitHub Advisoryadvisory · Packagist

GHSA-fvrh-wrpf-6q7h Formwork Cross-site Scripting (XSS) from Page title field

MEDIUM Published 2023-02-10 Modified 2024-05-28 Official page ↗
Aliases
CVE-2023-24230
Ecosystem
Packagist
Packages
getformwork/formwork
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-28

Affected packages

• Packagist getformwork/formwork: < 1.13.0 → fixed in 1.13.0

Description

Description A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field. Patched versions This vulnerability has been patched in Formwork 1.13.0.

Related

Alias · CVE (1)

  • CVE-2023-24230 A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References