CVE-2024-47819

Description

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.

Risk Information

Base Score

8.7

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS Score

Exploitation Probability

0.49

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-47819 are fixed in Nuget - Umbraco.Cms.StaticAssets 14.3.1	Windows
Vulnerabilities CVE-2024-47819 are fixed in Nuget - Umbraco.Cms.StaticAssets for Linux 14.3.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234