GitHub Advisoryadvisory · NuGet

GHSA-gvpc-3pj6-4m9w Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane

MEDIUM Published 2024-05-21 Modified 2025-02-12 Official page ↗
Aliases
CVE-2024-35218
Ecosystem
NuGet
Packages
UmbracoCms.Core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-05-21

Affected packages

• NuGet UmbracoCms.Core: >= 8.0.0, < 8.18.13 → fixed in 8.18.13 • NuGet UmbracoCms.Core: >= 10.0.0, < 10.8.4 → fixed in 10.8.4 • NuGet UmbracoCms.Core: >= 12.0.0, < 12.3.7 → fixed in 12.3.7 • NuGet UmbracoCms.Core: >= 13.0.0, < 13.1.1 → fixed in 13.1.1

Description

Impact Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. Affected versions Umbraco CMS >= 8.00 Patches This is fixed in 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer

Related

Alias · CVE (1)

  • CVE-2024-35218 Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References