En bref
- CVE-2024-35218 est une vulnérabilité MOYENNE (CVSS 4.8) touchant UmbracoCms.Core, umbraco cms (umbraco).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 29.1% des vulnérabilités.
- Correctif : mettre à jour vers 10.8.4, 12.3.7, 13.1.1, 8.18.13 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| UmbracoCms.Core NuGet | ≥ 10.0.0, < 10.8.4≥ 12.0.0, < 12.3.7≥ 13.0.0, < 13.1.1≥ 8.0.0, < 8.18.13
| 10.8.412.3.713.1.18.18.13
|
| umbraco cms | ≥ 10.0.0, < 10.8.4≥ 12.0.0, < 12.3.7≥ 13.0.0, < 13.1.1≥ 8.0.0, < 8.18.13
| 10.8.412.3.713.1.18.18.13
|
Description
Impact
Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application.
Affected versions
Umbraco CMS >= 8.00
Patches
This is fixed in 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer
NVD description
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free