PT-2024-26571 · Formwork · Formwork

Kyokito1412 · Published 2024-05-28 · Updated 2024-05-28 · CVE-2024-35621

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 1.13.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field. Users with access to the administration panel with page editing permissions could insert <script> tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.

Recommendations For versions prior to 1.13.0, update to Formwork 1.13.0 or later, which includes a patch that solves this vulnerability by introducing the content.safe mode system config option to control whether HTML tags and potentially dangerous links are escaped. As a temporary workaround, consider restricting access to the administration panel to a controlled group of editors to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-35621

GHSA-GX8M-F3MP-FG99

Affected Products

Formwork

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-35621 · Security Note
• https://osv.dev/vulnerability/GHSA-gx8m-f3mp-fg99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35621 · Vendor Advisory
• https://github.com/getformwork/formwork · Note
• https://github.com/getformwork/formwork/commit/2d92e6dbf99a9a49797947afbda0cdd4e56e11df · Note
• https://github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723 · Note
• https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99 · Note