CVE-2024-35218CWE-79

Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane

Medium · published May 21, 2024

CVSS v3.1
4.2
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-21T13:42Z
EPSS history
Timeline
  • 21 MAY 13:42Z
    Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
    cvelistv5