2.7low
CVE-2024-35239
Stored Cross-site Scripting on Components of Umbraco Forms
Also known as GHSA-p572-p2rj-q5f4
Published 2 y ago · modified 4 mo ago · JSON
CVSS
2.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 28%
Public exploits
0
none known
Summary
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.34% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Forms | >=13.0.0, <13.0.1 >=12.0.0, <12.2.2 >=10.0.0, <10.5.3 >=8.0.0, <8.13.13 | 13.0.1 12.2.2 10.5.3 8.13.13 |
Affected products
- umbraco Umbraco.Forms.Issues
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- github.com /umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4 · x_refsource_CONFIRM, x_transferred
- docs.umbraco.com /umbraco-forms/developer/configuration#editing-configuration-values · x_refsource_MISC, x_transferred
- docs.umbraco.com /umbraco-forms/release-notes#id-13.0.1-january-16th-2024 · x_refsource_MISC, x_transferred
- docs.umbraco.com /umbraco-forms/v/10.forms.latest/release-notes · x_refsource_MISC, x_transferred
- docs.umbraco.com /umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2024-35239 · advisory
- docs.umbraco.com /umbraco-forms/v/10.forms.latest/release-notes#version-8 · web
- github.com /umbraco/Umbraco.Forms.Issues · package
Sources
- CVE List: CVE-2024-35239
- GitHub Advisory: GHSA-p572-p2rj-q5f4
- NVD: CVE-2024-35239
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.