CVE-2024-35191

May 20, 2024, 9:15 p.m.

4.4
Medium

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Product(s) Impacted

Product Versions
Formie
  • ['before 2.1.6']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://github.com/verbb/formie/commit/90296edf7e707f117e760aa57e70dbd43a854420
https://github.com/verbb/formie/security/advisories/GHSA-v45m-hxqp-fwf5

Tags

security-advisories@github.com
2024-05-20
CVE-2024-35191
CWE-1336

CVSS Score

4.4 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: May 20, 2024, 9:15 p.m.
Last Modified: May 20, 2024, 9:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.