Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting

보통 6.5CVE-2024-55488 · GHSA-572q-86rr-5vgq · Published 22/01/2025 · updated 05/07/2026

요약

CVE-2024-55488은(는) Umbraco.Cms.Infrastructure, umbraco cms (umbraco)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.33%, 전체 취약점의 26.4%보다 높음.
조치: 15.0.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
Umbraco.Cms.Infrastructure NuGet	`< 15.0.0`	`15.0.0`
umbraco cms umbraco	`= 14.3.1`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because the issue is a documented security. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5270.

Original Advisory

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

NVD description

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.

References

Umbraco.Cms.Infrastructure의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

Umbraco.Cms.Infrastructure

NuGet

< 15.0.0

15.0.0

umbraco cms

umbraco

= 14.3.1

No fix yet

Description

Withdrawn Advisory

Original Advisory

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

NVD description