GitHub_MVULNRICHMENT:CVE-2024-35239CVE-2024-35239 Stored Cross-site Scripting on Components of Umbraco Forms
2.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.6%
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
CNA Affected
[
{
"vendor": "umbraco",
"product": "Umbraco.Forms.Issues",
"versions": [
{
"version": ">= 13.0.0, < 13.0.1",
"status": "affected"
},
{
"version": ">= 12.0.0, < 12.2.2",
"status": "affected"
},
{
"version": ">= 10.0.0, < 10.5.3",
"status": "affected"
},
{
"version": "< 8.13.13 ",
"status": "affected"
}
]
}
]References
docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4
Related
2.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.6%