PT-2021-11270 · Formstone · Formstone

Adriano Monteiro · Published 2021-01-07 · Updated 2022-05-24 · CVE-2020-26768

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Formstone versions 1.4.16 and earlier

Description: The issue is caused by improper validation of user-supplied input in the upload-target.php and upload-chunked.php files, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. This could allow the attacker to steal the victim's cookie-based authentication credentials, force malware execution, or perform user redirection.

Recommendations: For Formstone versions 1.4.16 and earlier, consider disabling the upload-target.php and upload-chunked.php files as a temporary workaround until a patch is available. Restrict access to these files to minimize the risk of exploitation. Avoid using specially crafted URLs that could trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26768

GHSA-WC29-H54Q-Q8QX

Affected Products

Formstone

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-26768 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc29-h54q-q8qx · Vendor Advisory
• https://github.com/Formstone/Formstone/commit/b067f31f5f6a0acd3ade4fd6dccae6e3633caa02 · Note
• https://github.com/Formstone/Formstone/issues/286 · Note
• https://t.me/cibsecurity/21748 · Telegram Post