CVE-2024-10761

MEDIUM

Umbraco CMS <= 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1 - Cross-Site Scripting via Dashboard Preview Frame Culture Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.

References (5)

Core 5
Core References
Permissions Required, Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.282930
Permissions Required, Third Party Advisory, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.282930
Exploit, Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.427091

Scores

CVSS v3 4.3
EPSS 0.0021
EPSS Percentile 43.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-94 CWE-79
Status published
Products (3)
nuget/Umbraco.Cms 11.0.0 - 13.5.3NuGet
nuget/Umbraco.Cms.Web.Common 11.0.0 - 13.5.3NuGet
umbraco/umbraco_cms 12.3.6
Published Nov 04, 2024
Tracked Since Feb 18, 2026