medium4.8
CVE-2023-24230
Formwork Cross-site Scripting (XSS) from Page title field
Impact
### Description A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field. ### Patched versions This vulnerability has been patched in [Formwork 1.13.0](https://github.com/getformwork/formwork/releases/tag/1.13.0).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getformwork/formwork | < 1.13.0 | 1.13.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Formwork Project | Formwork | Version 1.12.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/getformwork/formwork/releases/tag/1.12.1
- https://medium.com/%400x2bit/formwork-1-12-1-stored-xss-vulnerability-at-page-title-b6efba27891a
- https://github.com/advisories/GHSA-fvrh-wrpf-6q7h
- https://nvd.nist.gov/vuln/detail/CVE-2023-24230
- https://medium.com/@0x2bit/formwork-1-12-1-stored-xss-vulnerability-at-page-title-b6efba27891a
- https://github.com/getformwork/formwork/commit/8781ee17ca9b9b7b0b57e090e7f2ba1b27dc1415