CVE-2024-10761

Umbraco CMS Dashboard frame cross site scripting

State: Published
Severity: 6.9 Medium
Published: Nov 4, 2024
Updated: Jan 22, 2025
Reserved: Nov 3, 2024

Description

A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
CMSUmbraco	10.7.0Affected 10.7.1Affected 10.7.2Affected 10.7.3Affected 10.7.4Affected 10.7.5Affected 10.7.6Affected 10.7.7Affected 12.3.0Affected 12.3.1Affected 12.3.2Affected 12.3.3Affected 12.3.4Affected 12.3.5Affected 12.3.6Affected 13.5.0Affected 13.5.1Affected 13.5.2Affected 14.3.0Affected 14.3.1Affected 15.1.0Affected 15.1.1Affected

References

VDB-282930 | Umbraco CMS Dashboard frame cross site scriptingvdb-entrytechnical-description
VDB-282930 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #427091 | Umbraco Umbraco CMS Version 12.3.6 Cross Site Scriptingthird-party-advisory
https://drive.google.com/file/d/1YoZgdlS3QT7Xu005j9RO-FFUT8RbB0Da/view?usp=sharingbroken-linkexploit
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-69cg-w8vm-h229related

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.