Vulnerability · Published May 28, 2024 · Assigned by GitHub_M
CVE-2024-35239Stored Cross-site Scripting on Components of Umbraco Forms
Low 2.7
In plain English
A low-severity cross-site scripting in Umbraco.Forms.Issues from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | umbraco.forms | 13.0.1 | GHSA-p572-p2rj-q5f4 |
| NuGet | umbraco.forms | 12.2.2 | GHSA-p572-p2rj-q5f4 |
| NuGet | umbraco.forms | 10.5.3 | GHSA-p572-p2rj-q5f4 |
| NuGet | umbraco.forms | 8.13.13 | GHSA-p572-p2rj-q5f4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| umbraco | Umbraco.Forms.Issues | >= 13.0.0, < 13.0.1>= 12.0.0, < 12.2.2>= 10.0.0, < 10.5.3< 8.13.13 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4 x_refsource_CONFIRM
- https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values x_refsource_MISC
- https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 x_refsource_MISC
- https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes x_refsource_MISC
- https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 x_refsource_MISC