CVEvulnerability

CVE-2024-55488

6.5 MEDIUM Published 2025-01-22 Modified 2026-07-05 Official page ↗

Status: Modified
Published: 2025-01-22
Last modified: 2026-07-05
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.

Affected configurations

• umbraco umbraco cms 14.3.1

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://docs.umbraco.com/umbraco-cms/develop-with-umbraco/templating-and-rendering/design/stylesheets-javascript docs.umbraco.com
https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scripting-in-umbraco-rich-text-display/ Exploit, Third Party Advisory

CVE-2024-55488

Description

Affected configurations

Related

Weakness · CWE (1)

References