CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata

Medium 4.8 Published 7 Jun 2024 Updated 2 Aug 2024

An administrator can inject persistent XSS via site options, allowing arbitrary script execution for visitors on all pages except the dashboard.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-37160?

CVE-2024-37160 is a medium-severity cross-site scripting vulnerability in getformwork formwork, published on 7 Jun 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.

Weakness: CWE-79

Which versions are affected by CVE-2024-37160?

4 open source packages ship an affected version, including getformwork/formwork. It affects 1 product.

Package	Affected	Fixed in
`getformwork/formwork` Packagist	All versions	`1.13.1`
`getformwork/formwork` Packagist	All versions	`1.13.1`
`getformwork/formwork` Packagist	From `2.0.0-beta.1`	`2.0.0-beta.2`
`getformwork/formwork` Packagist	From `2.0.0-beta.1`	`2.0.0-beta.2`

Products include Formwork Project Formwork.

How do I fix CVE-2024-37160?

Upgrade getformwork/formwork to a fixed version for your release line: 1.13.1 or 2.0.0-beta.2.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-37160 being exploited?

There is no known exploitation of CVE-2024-37160 in the wild and no public exploit code.

Sources

Also known as GHSA-5pxr-7m4j-jjc6.