We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-35191

verbb/formie Server-Side Template Injection for variable-enabled settings



Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Reserved 2024-05-10 | Published 2024-05-20 | Updated 2024-08-02 | Assigner GitHub_M


MEDIUM: 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

< 2.1.6
affected

References

github.com/...formie/security/advisories/GHSA-v45m-hxqp-fwf5

github.com/...ommit/90296edf7e707f117e760aa57e70dbd43a854420

cve.org (CVE-2024-35191)

nvd.nist.gov (CVE-2024-35191)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-35191

Support options

Helpdesk Chat, Email, Knowledgebase