CVE-2023-38694

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-38694
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38694.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-38694
Aliases
Published
2023-12-12T17:09:08.237Z
Modified
2026-04-10T04:59:49.620371Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Umbraco CMS vulnerable to possible injection of HTML in an unintended form
Details

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38694.json"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
b8db430615d76521a4394a23f9928dc7c12f87bd
Fixed
365621023a2e12975104de36e1cbec0829d82804
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.18.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
4f06c1f33a54daf4752a439778626202960db68c
Fixed
fd043f6ecf7b45aea1ec4dfdf2097c5673b0bff5
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0-rc001"
        },
        {
            "fixed": "10.7.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
38712dce16aa9412af3d81d4884bfc6e5533e019
Fixed
d9c3ebdfe80b570777943633e9b97176b002e342
Database specific 
{
    "versions": [
        {
            "introduced": "11.0.0-rc1"
        },
        {
            "fixed": "12.1.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38694.json"