CVE-2024-37156: TokenController formName not sanitized in hidden input

June 6, 2024

TokenController get parameter formName not sanitized in returned input field leads to XSS.

What kind of vulnerability is it? Who is impacted?

References

github.com/advisories/GHSA-rrvc-c7xg-7cf3
github.com/sulu/SuluFormBundle
github.com/sulu/SuluFormBundle/commit/3f341b71a7309cbc8fd2c5bff894c654d1679b17
github.com/sulu/SuluFormBundle/security/advisories/GHSA-rrvc-c7xg-7cf3
nvd.nist.gov/vuln/detail/CVE-2024-37156

Detect and mitigate CVE-2024-37156 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →