-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the tokenAction method handling user-controlled input (formName parameter) without proper output encoding. The commit diff shows the fix added htmlspecialchars() sanitization for both formName and csrfToken variables before inserting them into the HTML output. The added test case specifically verifies XSS prevention by checking script tag escaping. This confirms the pre-patch version of tokenAction was vulnerable to XSS through unescaped formName parameter reflection in HTML output.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sulu/form-bundle | composer | >= 2.0.0, < 2.5.3 | 2.5.3 |