Umbraco CMS Vulnerable to Cross-Site Scripting Attacks
CVE-2024-35218

4.2MEDIUM

Key Information:

Vendor
Umbraco
Status
Umbraco-cms
Vendor
CVE Published:
21 May 2024

Summary

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

Affected Version(s)

Umbraco-CMS >= 8.0.0, < 8.18.13 < 8.0.0, 8.18.13

Umbraco-CMS >= 10.0.0, < 10.8.4 < 10.0.0, 10.8.4

Umbraco-CMS >= 12.0.0, < 12.3.7 < 12.0.0, 12.3.7

References

https://github.com/umbraco/Umbraco-CMS/security/advisorie...
x_refsource_CONFIRM
https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec5...
x_refsource_MISC
https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.