CVE-2024-10761

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10761
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://drive.google.com/file/d/1YoZgdlS3QT7Xu005j9RO-FFUT8RbB0Da/view?usp=sharing
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-69cg-w8vm-h229
https://vuldb.com/?ctiid.282930 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.282930 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?submit.427091 Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:umbraco:umbraco_cms:12.3.6:*:*:*:*:*:*:*
History

22 Jan 2025, 08:15

Type Values Removed Values Added
References
  • () https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-69cg-w8vm-h229 -
CVSS v2 : 4.0
v3 : 5.4 		v2 : 5.0
v3 : 4.3
Summary (en) A vulnerability was found in Umbraco CMS 12.3.6. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue. (en) A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.

13 Nov 2024, 11:15

Type Values Removed Values Added
References
  • () https://drive.google.com/file/d/1YoZgdlS3QT7Xu005j9RO-FFUT8RbB0Da/view?usp=sharing -

13 Nov 2024, 10:15

Type Values Removed Values Added
CWE CWE-707
CWE-74		 CWE-94
Summary (en) A vulnerability was found in Umbraco CMS 12.3.6. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. (en) A vulnerability was found in Umbraco CMS 12.3.6. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.

08 Nov 2024, 14:40

Type Values Removed Values Added
First Time Umbraco
Umbraco umbraco Cms
Summary
  • (es) Se ha encontrado una vulnerabilidad en Umbraco CMS 12.3.6. Se ha clasificado como problemática. Se ve afectada una función desconocida del archivo /Umbraco/preview/frame?id{} del componente Dashboard. La manipulación del argumento culture provoca ataques de cross site scripting. Es posible lanzar el ataque de forma remota. El exploit se ha hecho público y puede utilizarse.
CPE cpe:2.3:a:umbraco:umbraco_cms:12.3.6:*:*:*:*:*:*:*
CVSS v2 : 4.0
v3 : 3.5 		v2 : 4.0
v3 : 5.4
References () https://vuldb.com/?ctiid.282930 - () https://vuldb.com/?ctiid.282930 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.282930 - () https://vuldb.com/?id.282930 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.427091 - () https://vuldb.com/?submit.427091 - Exploit, Third Party Advisory, VDB Entry

04 Nov 2024, 07:15

Type Values Removed Values Added
CWE CWE-707
CWE-74

04 Nov 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-04 05:15

Updated : 2025-01-22 08:15

NVD link : CVE-2024-10761

Mitre link : CVE-2024-10761

CVE.ORG link : CVE-2024-10761

JSON object : View

Products Affected

umbraco

  • umbraco_cms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')