Umbraco CMS Vulnerable to Cross-Site Scripting Attacks

CVE-2024-35218

4.2MEDIUM

Key Information

Vendor: Umbraco
Status: Umbraco-cms
Vendor: CVE Published:; 21 May 2024

Summary

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

Affected Version(s)

Umbraco-CMS < 8.0.0, 8.18.13

Umbraco-CMS < 10.0.0, 10.8.4

Umbraco-CMS < 12.0.0, 12.3.7

CVSS V3.1

Score:

4.2

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

High

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published.
May 21, 2024
Vulnerability Reserved.
May 14, 2024

Collectors

NVD DatabaseMitre Database