CVE-2024-37160

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37160
Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6 Exploit Vendor Advisory
https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b Patch
https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:formwork_project:formwork:*:*:*:*:*:*:*:*
History

11 Jun 2024, 18:22

Type Values Removed Values Added
First Time Formwork Project
Formwork Project formwork
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
CPE cpe:2.3:a:formwork_project:formwork:*:*:*:*:*:*:*:*
References () https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5 - () https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5 - Patch
References () https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6 - () https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6 - Exploit, Vendor Advisory
References () https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b - () https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b - Patch

07 Jun 2024, 14:56

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-07 14:15

Updated : 2024-06-11 18:22

NVD link : CVE-2024-37160

Mitre link : CVE-2024-37160

JSON object : View

Products Affected

formwork_project

  • formwork
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')