CVE-2024-35218
Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
Severity Score
4.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.
Umbraco CMS es un CMS ASP.NET utilizado por más de 730.000 sitios web. El Cross Site Scripting (XSS) Almacenado permite a los atacantes que tienen acceso al backoffice introducir contenido malicioso en un sitio web o aplicación. Esta vulnerabilidad se ha solucionado en las versiones 8.18.13, 10.8.4, 12.3.7, 13.1.1 mediante la implementación de IHtmlSanitizer.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-05-14 CVE Reserved
- 2024-05-21 CVE Published
- 2024-05-22 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 8.0.0 < 8.18.13 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 8.0.0 < 8.18.13" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 10.0.0 < 10.8.4 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 10.0.0 < 10.8.4" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 12.0.0 < 12.3.7 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 12.0.0 < 12.3.7" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 13.0.0 < 13.1.1 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 13.0.0 < 13.1.1" | en |
Affected
| ||||||