Vulnerability Description
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Barrelstrengthdesign | Sprout Forms | < 3.9.0 |
Related Weaknesses (CWE)
References
- https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---Release Notes
- https://github.com/barrelstrength/craft-sprout-forms/security/advisories/GHSA-pxThird Party Advisory
- https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---Release Notes
- https://github.com/barrelstrength/craft-sprout-forms/security/advisories/GHSA-pxThird Party Advisory
FAQ
What is CVE-2020-11056?
CVE-2020-11056 is a vulnerability with a CVSS score of 7.4 (HIGH). In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has...
How severe is CVE-2020-11056?
CVE-2020-11056 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-11056?
Check the references section above for vendor advisories and patch information. Affected products include: Barrelstrengthdesign Sprout Forms.