PT-2025-9201 · Formwork · Formwork

Publicado 2025-03-01 · Atualizado 2025-03-01

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Formwork versions 2.x

Description The site title field at "/panel/options/site" allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. The attack leverages XSS and can impact system availability. By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.

Recommendations For Formwork version 2.x, update to a version that includes the patch that escapes the site title from the panel header navigation, such as the version committed in aa3e9c6. As a temporary workaround, consider restricting access to the site title field to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

GHSA-VF6X-59HH-332F

Produtos afetados

Formwork

Referências · 4

• https://github.com/getformwork/formwork · Nota
• https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2 · Nota
• https://github.com/getformwork/formwork/security/advisories/GHSA-vf6x-59hh-332f · Nota
• https://osv.dev/vulnerability/GHSA-vf6x-59hh-332f · Aviso do Fabricante