Lucene search

GitHub Advisory DatabaseGHSA-P572-P2RJ-Q5F4

HistoryMay 28, 2024 - 8:40 p.m.

Umbraco Forms components vulnerable to Stored Cross-site Scripting

2024-05-2820:40:31

CWE-79

GitHub Advisory Database

github.com

umbraco forms

stored cross-site scripting

authentication

patched versions

configuration values

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Impact

Authenticated user that has access to edit Forms may inject unsafe code into Forms components.

Patches

Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

References

https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values

Affected configurations

Vulners

Node

umbraco.formsRange<8.13.13

umbraco.formsRange<10.5.3

umbraco.formsRange<12.2.2

umbraco.formsRange<13.0.1

CPENameOperatorVersion
umbraco.formslt8.13.13
umbraco.formslt10.5.3
umbraco.formslt12.2.2
umbraco.formslt13.0.1

Name	Operator	Version
umbraco.forms	lt	8.13.13
umbraco.forms	lt	10.5.3
umbraco.forms	lt	12.2.2
umbraco.forms	lt	13.0.1

References

docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values

docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024

docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes

docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes#version-8

docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024

github.com/advisories/GHSA-p572-p2rj-q5f4

github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4

nvd.nist.gov/vuln/detail/CVE-2024-35239

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Related for GHSA-P572-P2RJ-Q5F4