What is GHSA-52vj-mr2j-f8jh?

GHSA-52vj-mr2j-f8jh is a security advisory published by GitHub Security Advisories with Critical severity. Server-Side Template Injection in formio

Which CVE IDs does GHSA-52vj-mr2j-f8jh cover?

GHSA-52vj-mr2j-f8jh covers the following CVE IDs: CVE-2020-28246. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-52vj-mr2j-f8jh?

GHSA-52vj-mr2j-f8jh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-52vj-mr2j-f8jh?

GHSA-52vj-mr2j-f8jh affects 1 product, including: npm/formio:\u003c= 2.0.0.

GHSA-52vj-mr2j-f8jhCriticalCVSS 9.8

Server-Side Template Injection in formio

Vendor

GitHub Security Advisories

Published

June 3, 2022

Last Modified

May 3, 2024

🔗 CVE IDs covered (1)

CVE-2020-28246 →

📋 Description

A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and only executable by admins.

🎯 Affected products1

npm/formio:<= 2.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-28246
https://github.com/formio/enterprise-release/blob/master/API-Server-Change-Log.md
https://github.com/formio/formio
https://github.com/advisories/GHSA-52vj-mr2j-f8jh