CVE-2020-11056
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which...
Summary
Potential Code Injection in Sprout Forms
Original description
The description as published by the source.
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
barrelstrength/sprout-base-email
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}]
Packagist
barrelstrength/sprout-forms
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com