GitHub_MVULNRICHMENT:CVE-2024-37160CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata
4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
7.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.1%
Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.
CNA Affected
[
{
"vendor": "getformwork",
"product": "formwork",
"versions": [
{
"version": "< 1.13.1",
"status": "affected"
},
{
"version": "= 2.0.0-beta.1",
"status": "affected"
}
]
}
]Related
4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
7.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.1%