PT-2023-24611 · Unknown+1 · Formcreator+1

Btrypublished · Published 2023-05-31 · Updated 2024-08-12 · CVE-2023-33971

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Formcreator versions 2.13.5 and prior

Description A stored cross-site scripting issue is present in the Formcreator plugin, potentially allowing arbitrary javascript code execution in an admin or tech context. This is due to the use of ##FULLFORM## for rendering. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of ##FULLFORM## which could lead to the execution of arbitrary javascript code. As a mitigation measure, using a regular expression to remove <, >, and " in all fields can help minimize the risk.

Recommendations For Formcreator versions 2.13.5 and prior, as a temporary workaround, consider using a regular expression to remove <, >, and " in all fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33971

GHSA-777G-3848-8R3G

Affected Products

Formcreator

Red Os

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33971.json · Exploit
• 🔥 https://github.com/pluginsGLPI/formcreator/security/advisories/GHSA-777g-3848-8r3g · Exploit
• https://osv.dev/vulnerability/CVE-2023-33971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33971 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-plugin-formcreator-cve-2023-33971 · Note