What is GHSA-fvrh-wrpf-6q7h?

GHSA-fvrh-wrpf-6q7h is a security advisory published by GitHub Security Advisories with Medium severity. Formwork Cross-site Scripting (XSS) from Page title field

Which CVE IDs does GHSA-fvrh-wrpf-6q7h cover?

GHSA-fvrh-wrpf-6q7h covers the following CVE IDs: CVE-2023-24230. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fvrh-wrpf-6q7h?

GHSA-fvrh-wrpf-6q7h has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-fvrh-wrpf-6q7h?

GHSA-fvrh-wrpf-6q7h affects 1 product, including: composer/getformwork/formwork:\u003c 1.13.0.

GHSA-fvrh-wrpf-6q7hMediumCVSS 4.8

Formwork Cross-site Scripting (XSS) from Page title field

Vendor

GitHub Security Advisories

Published

February 10, 2023

Last Modified

May 28, 2024

🔗 CVE IDs covered (1)

CVE-2023-24230 →

📋 Description

Description

A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field.

Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field.

Patched versions

This vulnerability has been patched in Formwork 1.13.0.

🎯 Affected products1

composer/getformwork/formwork:< 1.13.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-24230
https://medium.com/@0x2bit/formwork-1-12-1-stored-xss-vulnerability-at-page-title-b6efba27891a
https://github.com/getformwork/formwork/commit/8781ee17ca9b9b7b0b57e090e7f2ba1b27dc1415
https://github.com/advisories/GHSA-fvrh-wrpf-6q7h