PT-2023-31146 · Microsoft · Asp.Net

S3Ntago

·

Published

2023-12-12

·

Updated

2023-12-15

·

CVE-2023-49279

CVSS v3.1

3.7

Low

VectorAV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Umbraco versions 7.0.0 through 7.15.10 Umbraco versions 8.0.0 through 8.18.8 Umbraco versions 10.0.0 through 10.6.9 Umbraco versions 11.0.0 through 11.4.9 Umbraco versions 12.0.0 through 12.1.9
Description Umbraco is an ASP.NET content management system (CMS). A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
Recommendations For versions 7.0.0 through 7.15.10, update to version 7.15.11 or later. For versions 8.0.0 through 8.18.8, update to version 8.18.9 or later. For versions 10.0.0 through 10.6.9, update to version 10.7.0 or later. For versions 11.0.0 through 11.4.9, update to version 11.5.0 or later. For versions 12.0.0 through 12.1.9, update to version 12.2.0 or later. As a temporary workaround, consider implementing server-side file validation or serving all media from a different host (e.g., CDN) than where Umbraco is hosted.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49279
GHSA-6XMX-85X3-4CV2

Affected Products

Asp.Net