CVE-2018-17256

2018-11-2719:29:00

Google

osv.dev

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.

CPENameOperatorVersion
umbraco-cmseqrelease-7.3.2
umbraco-cmseqrelease-7.7.1
umbraco-cmseqrelease-6.0.4
umbraco-cmseqdev-7.6-alpha075
umbraco-cmseqdev-7.6-beta02
umbraco-cmseqrelease-7.2.0-beta2
umbraco-cmseqrelease-7.6.6
umbraco-cmseqrelease-7.0.2
umbraco-cmseqrelease-7.1.7
umbraco-cmseqrelease-4.11.7

Name	Operator	Version
umbraco-cms	eq	release-7.3.2
umbraco-cms	eq	release-7.7.1
umbraco-cms	eq	release-6.0.4
umbraco-cms	eq	dev-7.6-alpha075
umbraco-cms	eq	dev-7.6-beta02
umbraco-cms	eq	release-7.2.0-beta2
umbraco-cms	eq	release-7.6.6
umbraco-cms	eq	release-7.0.2
umbraco-cms	eq	release-7.1.7
umbraco-cms	eq	release-4.11.7