CVE-2024-35621
published 2024-05-28CVE-2024-35621: A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a…
PriorityP417medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.27%
18.6th percentile
A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getformwork | formwork | >= 0 < 1.13.0 | 1.13.0 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
ghsa4.8MEDIUM
osv4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
formwork Cross-site scripting vulnerability in Markdown fields
ghsa·2024-05-28·CVSS 4.8
CVE-2024-35621 [MEDIUM] CWE-79 formwork Cross-site scripting vulnerability in Markdown fields
formwork Cross-site scripting vulnerability in Markdown fields
### Impact
Users with access to the administration panel with page editing permissions could insert `` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.
### Patches
- [**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released with a patch that solves this vulnerability. Now the system config option `content.safe_mode` (enabled by default) controls whether HTML tags and potentially dangerous links are escaped. This is configurable as in some cases more flexibility should be given. Panel users should be only a controlled group of editors, which cannot enable the option by themselves, and not a generic group. This miti
OSV
formwork Cross-site scripting vulnerability in Markdown fields
osv·2024-05-28·CVSS 4.8
CVE-2024-35621 [MEDIUM] formwork Cross-site scripting vulnerability in Markdown fields
formwork Cross-site scripting vulnerability in Markdown fields
### Impact
Users with access to the administration panel with page editing permissions could insert `` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.
### Patches
- [**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released with a patch that solves this vulnerability. Now the system config option `content.safe_mode` (enabled by default) controls whether HTML tags and potentially dangerous links are escaped. This is configurable as in some cases more flexibility should be given. Panel users should be only a controlled group of editors, which cannot enable the option by themselves, and not a generic group. This miti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-28
Published