PT-2025-3119 · Umbraco · Umbraco Cms

Published 2024-12-06 · Updated 2025-12-31 · CVE-2024-55488

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 14.3.1

Description A stored cross-site scripting (XSS) vulnerability in Umbraco CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This issue is only possible via authenticated users who have been manually allowed access to the CMS, as there was a deliberate decision made not to apply HTML sanitization at the product level.

Recommendations For Umbraco CMS version 14.3.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-01597

CVE-2024-55488

GHSA-572Q-86RR-5VGQ

Affected Products

Umbraco Cms

References · 17

• 🔥 https://nccgroup.com/us/research-blog/technical-advisory-cross-site-scripting-in-umbraco-rich-text-display · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55488 · Security Note
• https://bdu.fstec.ru/vul/2025-01597 · Security Note
• https://osv.dev/vulnerability/GHSA-572q-86rr-5vgq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55488 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://github.com/umbraco/Umbraco-CMS/pull/17164 · Note
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-15.0.0-rc1 · Note
• https://github.com/github/advisory-database/pull/5270 · Note
• http://umbraco.com · Note
• https://twitter.com/Hossted_OSS/status/1886300618249093315 · Twitter Post
• https://t.me/cvedetector/16118 · Telegram Post
• https://t.me/cvenotify/111144 · Telegram Post
• https://vuldb.com/?id.293077 · Note
• https://twitter.com/CVEnew/status/1882300224305053753 · Twitter Post