VulnerabilityModified
CVE-2024-37156
The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS.
MEDIUM 6.1EPSS 0.29%
Does this matter?
Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.
Description
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.29% probability · 22th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-80
- Affected
- sulu/suluformbundle
- Source
- security-advisories@github.com
References
- https://github.com/sulu/SuluFormBundle/commit/3f341b71a7309cbc8fd2c5bff894c654d1679b17Patch
- https://github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3Vendor Advisory
- https://github.com/sulu/SuluFormBundle/commit/3f341b71a7309cbc8fd2c5bff894c654d1679b17Patch
- https://github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.