PT-2023-30776 · Umbraco · Umbraco

Raphael · Published 2023-12-12 · Updated 2023-12-14 · CVE-2023-48313

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 10.0.0 through 10.8.0 Umbraco versions 10.8.1 is not affected, but versions prior to 12.3.4 are affected, so the correct range is: Umbraco versions 10.8.2 through 12.3.3

Description The issue is a cross-site scripting (XSS) vulnerability that allows attackers to bring malicious content into a website or application. This can be exploited when users are successfully logging into the Backoffice, specifically through a DOM-XSS vulnerability.

Recommendations For Umbraco versions 10.0.0 through 10.8.0, update to version 10.8.1 to resolve the issue. For Umbraco versions 10.8.2 through 12.3.3, update to version 12.3.4 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48313

GHSA-V98M-398X-269R

Affected Products

Umbraco

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48313.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-v98m-398x-269r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48313 · Security Note
• https://osv.dev/vulnerability/GHSA-v98m-398x-269r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48313 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/CVEnew/status/1734629323875987527 · Twitter Post