Cross-Site Scripting Vulnerability in Umbraco CMS by Umbraco
CVE-2025-24012

5.4MEDIUM

Key Information:

Vendor

Umbraco

Status
Umbraco-cms
Vendor
CVE Published:
21 January 2025

What is CVE-2025-24012?

Umbraco CMS, a popular open-source .NET content management system, is susceptible to a cross-site scripting vulnerability affecting authenticated users. This security flaw exists in localized backoffice components from version 14.0.0 up until the patched versions 14.3.2 and 15.1.2. If exploited, the vulnerability could allow attackers to inject malicious scripts, potentially compromising user data and session integrity. Users are recommended to upgrade to the latest patched versions to mitigate any risks associated with this vulnerability.

Affected Version(s)

Umbraco-CMS >= 14.0.0, < 14.3.2 < 14.0.0, 14.3.2

Umbraco-CMS >= 15.0.0, < 15.1.2 < 15.0.0, 15.1.2

References

https://github.com/umbraco/Umbraco-CMS/security/advisorie...
x_refsource_CONFIRM
https://github.com/umbraco/Umbraco-CMS/commit/d4f8754f933...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.