p PatchFirst

CVE-2024-37156

CVE-2024-37156 · TokenController formName not sanitized in hidden input

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.

CVSS 6.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • suluformbundle

    Versions
    • >=2.0.0, < 2.5.3: Affected

    No fix published

  • sulu/form-bundle Packagist

    Versions
    • 2.0.0
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.5.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.5.3

    Update to 2.5.3

Original sources

Check your server →