Kurz gesagt
- CVE-2023-38694 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in Umbraco.CMS, umbraco cms (umbraco).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.41%, höher als bei 35.3% aller Schwachstellen.
- Abhilfe: auf 12.1.0, 8.18.10, 10.7.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.CMS NuGet | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
| umbraco cms | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
Description
Impact
A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.
Explanation of the vulnerability
A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.
NVD description
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free