In short
- CVE-2023-38694 is a MEDIUM (CVSS 5.4) vulnerability affecting Umbraco.CMS, umbraco cms (umbraco).
- Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.3% of all vulnerabilities.
- Fix: update to 12.1.0, 8.18.10, 10.7.0 or later.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.CMS NuGet | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
| umbraco cms | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
Description
Impact
A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.
Explanation of the vulnerability
A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.
NVD description
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free