En bref
- CVE-2023-38694 est une vulnérabilité MOYENNE (CVSS 5.4) touchant Umbraco.CMS, umbraco cms (umbraco).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.41%, plus élevée que 35.3% des vulnérabilités.
- Correctif : mettre à jour vers 12.1.0, 8.18.10, 10.7.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.CMS NuGet | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
| umbraco cms | ≥ 11.0.0, < 12.1.0≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.7.0
| 12.1.08.18.1010.7.0
|
Description
Impact
A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.
Explanation of the vulnerability
A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.
NVD description
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free