TI-2021-12365 Aliases CVE-2021-32697 GHSA-m5vx-8chx-qvmm

Form validation can be skipped

LOW 31CWE-20Published 2021-06-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data. Alternatively a custom Finisher can be added as first finisher. This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567

Why it matters now

EPSS 0.01124 66th percentileScored 2026-11-07

Fix Fixed form (neos): 4.3.3, 5.0.9, 5.1.3neos/form (Packagist): 4.3.3, 5.0.9, 5.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
neos	form	1.2.0 to before 4.3.3; 5.0.0 to before 5.0.9; 5.1.0 to before 5.1.3	4.3.3, 5.0.9, 5.1.3	Patch available	CNA
—	neos/form (Packagist)	1.2.0 to before 4.3.3	4.3.3	Patch available	GHSA-m5vx-8chx-qvmm
—	neos/form (Packagist)	5.0.0 to before 5.0.9	5.0.9	Patch available	GHSA-m5vx-8chx-qvmm
—	neos/form (Packagist)	5.1.0 to before 5.1.3	5.1.3	Patch available	GHSA-m5vx-8chx-qvmm

form Vendorneos Affected 1.2.0 to before 4.3.3; 5.0.0 to before 5.0.9; 5.1.0 to before 5.1.3 Fixed in 4.3.3, 5.0.9, 5.1.3 Patch available CNA
neos/form (Packagist) Vendor— Affected 1.2.0 to before 4.3.3 Fixed in 4.3.3 Patch available GHSA-m5vx-8chx-qvmm
neos/form (Packagist) Vendor— Affected 5.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-m5vx-8chx-qvmm
neos/form (Packagist) Vendor— Affected 5.1.0 to before 5.1.3 Fixed in 5.1.3 Patch available GHSA-m5vx-8chx-qvmm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:neos:form::::::::	1.2.0 to before 4.3.3; 5.0.0 to before 5.0.9; 5.1.0 to before 5.1.3	Vulnerable	neos

cpe:2.3:a:neos:form:*:*:*:*:*:*:*:* Versions 1.2.0 to before 4.3.3; 5.0.0 to before 5.0.9; 5.1.0 to before 5.1.3 Vulnerable ·neos

Remediation

Fix · CNA form (neos) Fixed in 4.3.3, 5.0.9, 5.1.3
Fix · GHSA-m5vx-8chx-qvmm neos/form (Packagist) Fixed in 4.3.3 Advisory →
Fix · GHSA-m5vx-8chx-qvmm neos/form (Packagist) Fixed in 5.0.9 Advisory →
Fix · GHSA-m5vx-8chx-qvmm neos/form (Packagist) Fixed in 5.1.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32697
2026-10-03 Alias added: GHSA-m5vx-8chx-qvmm

References

Patch 2

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences