GitHub Advisoryadvisory · NuGet

GHSA-v98m-398x-269r DOM-XSS on Backoffice login screen.

MEDIUM Published 2023-12-13 Modified 2024-01-12 Official page ↗
Aliases
CVE-2023-48313
Ecosystem
NuGet
Packages
Umbraco.CMS
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-12-13

Affected packages

• NuGet Umbraco.CMS: >= 10.0.0, < 10.8.1 → fixed in 10.8.1 • NuGet Umbraco.CMS: >= 11.0.0, < 12.3.4 → fixed in 12.3.4

Description

Impact Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application. Explanation of the vulnerability A DOM-XSS can be exploited when users are successfully logging into the Backoffice.

Related

Alias · CVE (1)

  • CVE-2023-48313 Umbraco is an ASP.NET content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References