CVE-2020-11056
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which...
Résumé
Potential Code Injection in Sprout Forms
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Packagist
barrelstrength/sprout-base-email
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}]
Packagist
barrelstrength/sprout-forms
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com