THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-35191

verbb/formie Server-Side Template Injection for variable-enabled settings

Reserved:2024-05-10
Published:2024-05-20
Updated:2024-06-06

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.



MEDIUM: 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

< 2.1.6
affected

References

https://github.com/verbb/formie/security/advisories/GHSA-v45m-hxqp-fwf5

https://github.com/verbb/formie/commit/90296edf7e707f117e760aa57e70dbd43a854420

cve.org CVE-2024-35191

nvd.nist.gov CVE-2024-35191

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-35191