Umbraco Commerce Vulnerability: Unsafe Code Injection in Forms
CVE-2024-35239

2.7LOW

Key Information:

Vendor

Umbraco

Status
Umbraco.forms.issues
Vendor
CVE Published:
28 May 2024

What is CVE-2024-35239?

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

Affected Version(s)

Umbraco.Forms.Issues >= 13.0.0, < 13.0.1 < 13.0.0, 13.0.1

Umbraco.Forms.Issues >= 12.0.0, < 12.2.2 < 12.0.0, 12.2.2

Umbraco.Forms.Issues >= 10.0.0, < 10.5.3 < 10.0.0, 10.5.3

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/...
x_refsource_CONFIRM
https://docs.umbraco.com/umbraco-forms/developer/configur...
x_refsource_MISC
https://docs.umbraco.com/umbraco-forms/release-notes#id-1...
x_refsource_MISC

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.