Lucene search

CVE-2024-37160

🗓️ 07 Jun 2024 14:10:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 32 Views🌐 WEB

Formwork CMS Arbitrary Script Execution Vulnerability fixed in 1.13.1

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 7
OSV	GHSA-5PXR-7M4J-JJC6 Cross-site scripting (XSS) vulnerability in Description metadata	7 Jun 202419:37	–	osv
OSV	CVE-2024-37160	7 Jun 202414:15	–	osv
NVD	CVE-2024-37160	7 Jun 202414:15	–	nvd
Vulnrichment	CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata	7 Jun 202414:09	–	vulnrichment
Veracode	Cross Site Scripting (XSS)	12 Jun 202406:45	–	veracode
Cvelist	CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata	7 Jun 202414:09	–	cvelist
Github Security Blog	Cross-site scripting (XSS) vulnerability in Description metadata	7 Jun 202419:37	–	github

Nvd

Vulners

Vulnrichment

Node

formwork_project formworkRange<1.13.1

[
  {
    "vendor": "getformwork",
    "product": "formwork",
    "versions": [
      {
        "version": "< 1.13.1",
        "status": "affected"
      },
      {
        "version": "= 2.0.0-beta.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5
github	www.github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b
github	www.github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6

Parameter	Position	Path	Description	CWE
site options	request body	/panel/options/site	The endpoint allows attackers with administrator privileges to execute arbitrary web scripts by modifying site options.	CWE-79

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

07 Jun 2024 14:15Current

5.3Medium risk

Vulners AI Score5.3

CVSS34.8

EPSS0.00095

SSVC

CWE-79