CVE-2023-48313

2023-12-1218:15:22

CWE-79

GitHub_M

web.nvd.nist.gov

umbraco

asp.net

cms

xss

vulnerability

security

patch

10.8.1

12.3.4

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.

Affected configurations

Nvd

Vulners

Node

umbracoumbraco_cmsRange10.0.0–10.8.1

umbracoumbraco_cmsRange12.0.0–12.3.4

VendorProductVersionCPE
umbracoumbraco_cms*cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
umbraco	umbraco_cms	*	cpe:2.3:a:umbraco:umbraco_cms::::::::

CNA Affected

[
  {
    "vendor": "umbraco",
    "product": "Umbraco-CMS",
    "versions": [
      {
        "version": ">= 10.0.0, < 10.8.1",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0-rc1, < 12.3.4",
        "status": "affected"
      }
    ]
  }
]