GitHub Advisoryadvisory · NuGet, npm

GHSA-wv8v-rmw2-25wc XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

MEDIUM Published 2025-01-21 Modified 2025-02-20 Official page ↗
Aliases
CVE-2025-24012
Ecosystem
NuGet, npm
Packages
Umbraco.Cms.StaticAssets, @umbraco-cms/backoffice
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-01-21

Affected packages

• NuGet Umbraco.Cms.StaticAssets: >= 14.0.0, < 14.3.2 → fixed in 14.3.2 • NuGet Umbraco.Cms.StaticAssets: >= 15.0.0, < 15.1.2 → fixed in 15.1.2 • npm @umbraco-cms/backoffice: >= 14.0.0, < 14.3.2 → fixed in 14.3.2 • npm @umbraco-cms/backoffice: >= 15.0.0, < 15.1.2 → fixed in 15.1.2

Description

Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil

Related

Alias · CVE (1)

  • CVE-2025-24012 Umbraco is a free and open source .NET content management system. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References