Umbraco CMS Vulnerable to Cross-Site Scripting Attacks
CVE-2024-35218

4.8MEDIUM

Key Information:

Vendor

Umbraco

Status
Umbraco-cms
Vendor
CVE Published:
21 May 2024

What is CVE-2024-35218?

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

Affected Version(s)

Umbraco-CMS >= 8.0.0, < 8.18.13 < 8.0.0, 8.18.13

Umbraco-CMS >= 10.0.0, < 10.8.4 < 10.0.0, 10.8.4

Umbraco-CMS >= 12.0.0, < 12.3.7 < 12.0.0, 12.3.7

References

https://github.com/umbraco/Umbraco-CMS/security/advisorie...
x_refsource_CONFIRM
https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec5...
x_refsource_MISC
https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.