CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata

2024-06-0714:09:55

CWE-79

GitHub_M

www.cve.org

formwork cms

cross-site scripting

description metadata

administrator privilege

arbitrary web scripts

site options

persistence

dashboard

vulnerability

cve-2024-37160

fixed

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

20.0%

JSON

Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.

CNA Affected

[
  {
    "vendor": "getformwork",
    "product": "formwork",
    "versions": [
      {
        "version": "< 1.13.1",
        "status": "affected"
      },
      {
        "version": "= 2.0.0-beta.1",
        "status": "affected"
      }
    ]
  }
]