PT-2023-26559 · Umbraco · Umbraco

Bergmania · Published 2023-12-12 · Updated 2023-12-18 · CVE-2023-38694

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 8.0.0 through 8.18.9 Umbraco versions 8.18.10 is not affected, but versions prior to 10.7.0 are affected, so Umbraco versions 10.0.0 through 10.6.9 Umbraco versions 12.0.0 through 12.0.9

Description A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. This can be achieved by a person with access to the backoffice and the "users" section, who could send a user invite and inject HTML code into the invite message.

Recommendations For Umbraco versions 8.0.0 through 8.18.9, update to version 8.18.10 or later. For Umbraco versions 10.0.0 through 10.6.9, update to version 10.7.0 or later. For Umbraco versions 12.0.0 through 12.0.9, update to version 12.1.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38694

GHSA-XXC6-35R7-796W

Affected Products

Umbraco

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38694.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-xxc6-35r7-796w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38694 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38694 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xxc6-35r7-796w · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/CVEnew/status/1734626778759782665 · Twitter Post