Overview
If you have discovered a vulnerability in one of our products, we want to hear from you as soon as possible. Please gather as much information together as you can so we can work quickly to address it. Here’s a checklist of the details we’d like to see.
Note: this article is not intended for Gravity Forms customers. If you are a Gravity Forms customer, see How to Report a Security Issue.
Report Reference
| Detail | Description |
|---|---|
| Severity | High, medium, or low. |
| Vulnerability type | For example, DoS, Overflow, XSS, or CSRF. |
| Exploitation requires authentication? | Yes or no. |
| Affected version(s) | The version(s) of Gravity Forms (or the Add-On) affected. |
| Description | A description of the vulnerability. |
| Active exploitation | Let us know if you have reason to believe the vulnerability is being exploited. |
| Public exploit details | Let us know if details of an exploit are publicly available. If so, please provide us with a URL. |
| Potential impact | What is the potential impact? How do you envisage it being used in an attack scenario? |
| DREAD score | Include this if known. |
| CVE identifier / reference / advisory number | Include this if applicable. |
| Credit and disclosure timing | If you wish to be credited for the responsible disclosure in the release announcement and the change log, please let us know. If you plan to disclose details of the vulnerability, please let us know so we can coordinate the timing. |
| Additional comments | Anything else you’d like us to know? |
Send all the details to security@gravityforms.com
We’ll acknowledge receipt as soon as we’ve read it. If confirmed, we’ll plan a patch and let you know when we plan to release it.
Example Report
I’m reporting a medium-severity reflected XSS affecting Gravity Forms 2.9.0-2.9.3. A form field label is not properly escaped, allowing a crafted URL parameter to inject a script that executes in the browser of any visitor. Exploitation doesn’t require authentication.
I haven’t found any evidence of active exploitation or public details of exploits at this time. The potential impact is that a crafted link could be used to steal an authenticated admin’s session cookie via phishing, leading to account takeover. I’d estimate a DREAD score of 6.4 (medium), and no CVE has been assigned yet.
I’d like credit as “Jane Doe, Acme Security,” and I plan to publish a write-up 90 days after the patch is released, or sooner by mutual agreement. Happy to provide a proof-of-concept video on request.