CVE-2025-23041CWE-20

Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms

Medium · published January 14, 2025

CVSS v3.1
5.8
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-01-14T18:54Z
EPSS history
Timeline
  • 14 JAN 18:54Z
    Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
    cvelistv5