CVE-2023-33971: Formcreator vulnerable to stored XSS from ##FULLFORM##
Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of ##FULLFORM## for rendering. This could result in arbitrary javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, one may use a regular expression to remove < > " in all fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
As a workaround (since no patch is available), use a regular expression to remove `< > "` in all fields to mitigate stored XSS when rendering `##FULLFORM##` (affected: Formcreator 2.13.5 and prior).
Formcreator (GLPI plugin) Form rendering/input sanitization for ##FULLFORM## = Apply a regular expression to remove the characters `<`, `>`, and `"` in all fields
Event History
Frequently Asked Questions
What is CVE-2023-33971?
CVE-2023-33971 is a probable stored cross-site scripting vulnerability in Formcreator 2.13.5 and prior versions.
What is Formcreator?
Formcreator is a GLPI plugin that allows the creation of custom forms and the creation of tickets when the form is filled.
How does the vulnerability in Formcreator occur?
The vulnerability occurs through the use of `##FULLFORM##` for rendering.
What is the severity of CVE-2023-33971?
The severity of CVE-2023-33971 is medium with a CVSS severity score of 5.4.
How can I fix the vulnerability in Formcreator?
To fix the vulnerability, update Formcreator to version 2.13.6 or later.