CVE-2024-35621: formwork Cross-site scripting vulnerability in Markdown fields
Users with access to the administration panel with page editing permissions could insert <script> tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.
References
- github.com/advisories/GHSA-gx8m-f3mp-fg99
- github.com/getformwork/formwork
- github.com/getformwork/formwork/commit/2d92e6dbf99a9a49797947afbda0cdd4e56e11df
- github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723
- github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99
- nvd.nist.gov/vuln/detail/CVE-2024-35621
Code Behaviors & Features
Detect and mitigate CVE-2024-35621 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →