GitHub Advisoryadvisory · NuGet, npm

GHSA-c5g6-6xf7-qxp3 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

MEDIUM Published 2024-10-22 Modified 2024-10-22 Official page ↗
Aliases
CVE-2024-47819
Ecosystem
NuGet, npm
Packages
Umbraco.Cms.StaticAssets, @umbraco-cms/backoffice
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2024-10-22

Affected packages

• NuGet Umbraco.Cms.StaticAssets: >= 14.0.0, < 14.3.1 → fixed in 14.3.1 • npm @umbraco-cms/backoffice: >= 14.0.0, < 14.3.1 → fixed in 14.3.1

Description

Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Patches Will be patched in 14.3.1 and 15.0.0. Workarounds Ensure that access to the Dictionary section is only granted to trusted users.

Related

Alias · CVE (1)

  • CVE-2024-47819 Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and… vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References