XSS in Umbraco Umbraco-Cms
CVE-2023-49279
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (31.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
Affected products
- Umbraco Umbraco-cms — versions >= 7.0.0, < 7.15.11, >= 8.0.0, < 8.18.9, >= 9.0.0-rc001, < 10.7.0
- Umbraco Umbraco_cms
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-49279?
- CVE-2023-49279 is a low-severity vulnerability in Umbraco Umbraco-Cms, classified under Cross-site Scripting. CVSS score: 3.7/10. Published 2023-12-12.
- How severe is CVE-2023-49279?
- Low severity. CVSS v3 base score is 3.7 out of 10.