GitHub Advisoryadvisory · NuGet

GHSA-69cg-w8vm-h229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge

MEDIUM Published 2025-01-21 Modified 2025-02-19 Official page ↗
Aliases
CVE-2024-10761
Ecosystem
NuGet
Packages
Umbraco.Cms, Umbraco.Cms.Web.Common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-01-21

Affected packages

• NuGet Umbraco.Cms: >= 11.0.0, < 13.5.3 → fixed in 13.5.3 • NuGet Umbraco.Cms: >= 14.0.0, < 14.3.2 → fixed in 14.3.2 • NuGet Umbraco.Cms: >= 15.0.0, < 15.1.2 → fixed in 15.1.2 • NuGet Umbraco.Cms: >= 10.8.7, < 10.8.8 → fixed in 10.8.8 • NuGet Umbraco.Cms.Web.Common: >= 11.0.0, < 13.5.3 → fixed in 13.5.3 • NuGet Umbraco.Cms.Web.Common: >= 14.0.0, < 14.3.2 → fixed in 14.3.2 • NuGet Umbraco.Cms.Web.Common: >= 15.0.0, < 15.1.2 → fixed in 15.1.2 • NuGet Umbraco.Cms.Web.Common: >= 10.8.7, < 10.8.8 → fixed in 10.8.8

Description

Impact Authenticated users are able to exploit an XSS vulnerability when viewing previewed content. Patches Will be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2. Workarounds None available.

Related

Alias · CVE (1)

  • CVE-2024-10761 A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References