CVE-2023-38694

2023-12-1217:15:07

CWE-79

[email protected]

web.nvd.nist.gov

umbraco

cms

html injection

vulnerability

cve-2023-38694

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

13.3%

JSON

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.

Affected configurations

Vulners

NVD

Node

umbracoumbraco_cmsRange8.0.0–8.18.10

umbracoumbraco_cmsRange9.0.0-rc001–10.7.0

umbracoumbraco_cmsRange11.0.0-rc1–12.1.0

VendorProductVersionCPE
umbracoumbraco_cms*cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*
umbracoumbraco_cms*cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*
umbracoumbraco_cms*cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
umbraco	umbraco_cms	*	cpe:2.3:a:umbraco:umbraco_cms::::::::
umbraco	umbraco_cms	*	cpe:2.3:a:umbraco:umbraco_cms::::::::
umbraco	umbraco_cms	*	cpe:2.3:a:umbraco:umbraco_cms::::::::

CNA Affected

[
  {
    "vendor": "umbraco",
    "product": "Umbraco-CMS",
    "versions": [
      {
        "version": ">= 8.0.0, < 8.18.10",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0-rc001, < 10.7.0",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0-rc1, < 12.1.0",
        "status": "affected"
      }
    ]
  }
]