CVE-2023-49279
Description
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
How to fix
- umbraco umbraco_cms7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0 or later
- Umbraco.CMS7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| umbraco umbraco_cms | 7.0.0 ≤ v < 7.15.11, 8.0.0 ≤ v < 8.18.9, 10.0.0 ≤ v < 10.7.0, 11.0.0 ≤ v < 11.5.0, 12.0.0 ≤ v < 12.2.0 | 7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0 |
| Umbraco.CMSNuGet | 7.0.0 ≤ v < 7.15.11, 8.0.0 ≤ v < 8.18.9, 9.0.0 ≤ v < 10.7.0, 11.0.0 ≤ v < 11.5.0, 12.0.0 ≤ v < 12.2.0 | 7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.