CVE-2023-38694CWE-79

Umbraco CMS vulnerable to possible injection of HTML in an unintended form

Low · published December 12, 2023

CVSS v3.1
3.5
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-12-12T17:09Z
EPSS history
Timeline
  • 12 DEC 17:09Z
    Umbraco CMS vulnerable to possible injection of HTML in an unintended form
    cvelistv5