CVE-2020-11056CWE-94

Potential Code Injection in Sprout Forms

High · published May 7, 2020

CVSS v3.1
7.4
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01029 · 63.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2020-05-07T20:50Z
EPSS history
Timeline
  • 07 MAY 20:50Z
    Potential Code Injection in Sprout Forms
    cvelistv5