CVE-2024-35239
Low
Description
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
SeverityLow
CVSS2.7
Exploit probability—
Product
Umbraco Forms
PublishedMay 28, 2024
First seenMay 28, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- umbraco umbraco_forms8.13.13, 10.5.3, 12.2.2, 13.0.1 or later
- Umbraco.Forms13.0.1, 12.2.2, 10.5.3, 8.13.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| umbraco umbraco_forms | v < 8.13.13, 9.0.0 ≤ v < 10.5.3, 11.0.0 ≤ v < 12.2.2, 13.0.0 ≤ v < 13.0.1 | 8.13.13, 10.5.3, 12.2.2, 13.0.1 |
| Umbraco.FormsNuGet | 13.0.0 ≤ v < 13.0.1, 12.0.0 ≤ v < 12.2.2, 10.0.0 ≤ v < 10.5.3, 8.0.0 ≤ v < 8.13.13 | 13.0.1, 12.2.2, 10.5.3, 8.13.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.