Description

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.

INFO

Published Date :

2024-06-06T16:03:46.771Z

Last Modified :

2024-08-02T03:50:54.830Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-37156 vulnerability.

Vendors Products
Sulu
  • Suluformbundle
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-37156.

URL Resource
https://github.com/sulu/SuluFormBundle/commit/3f341b71a7309cbc8fd2c5bff894c654d1679b17 cve-icon cve-icon cve-icon
https://github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact