CVE-2024-10761

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10761
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10761.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10761
Aliases
Published
2024-11-04T05:00:06.691Z
Modified
2026-07-15T01:49:05.125587462Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Umbraco CMS Dashboard frame cross site scripting
Details

A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10761.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "10.7.1"
                },
                {
                    "last_affected": "10.7.1"
                },
                {
                    "introduced": "10.7.2"
                },
                {
                    "last_affected": "10.7.2"
                },
                {
                    "introduced": "10.7.3"
                },
                {
                    "last_affected": "10.7.3"
                },
                {
                    "introduced": "10.7.4"
                },
                {
                    "last_affected": "10.7.4"
                },
                {
                    "introduced": "10.7.5"
                },
                {
                    "last_affected": "10.7.5"
                },
                {
                    "introduced": "10.7.6"
                },
                {
                    "last_affected": "10.7.6"
                },
                {
                    "introduced": "10.7.7"
                },
                {
                    "last_affected": "10.7.7"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
fd043f6ecf7b45aea1ec4dfdf2097c5673b0bff5
Last affected
4f3dd044f66ab877f7bc42287867ee998c29e9eb
Database specific 
{
    "cpe": "cpe:2.3:a:umbraco:umbraco_cms:12.3.6:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "10.7.0"
        },
        {
            "last_affected": "10.7.0"
        },
        {
            "introduced": "12.3.0"
        },
        {
            "last_affected": "12.3.0"
        },
        {
            "introduced": "12.3.1"
        },
        {
            "last_affected": "12.3.1"
        },
        {
            "introduced": "12.3.2"
        },
        {
            "last_affected": "12.3.2"
        },
        {
            "introduced": "12.3.3"
        },
        {
            "last_affected": "12.3.3"
        },
        {
            "introduced": "12.3.4"
        },
        {
            "last_affected": "12.3.4"
        },
        {
            "introduced": "12.3.5"
        },
        {
            "last_affected": "12.3.5"
        },
        {
            "introduced": "12.3.6"
        },
        {
            "last_affected": "12.3.6"
        },
        {
            "introduced": "13.5.0"
        },
        {
            "last_affected": "13.5.0"
        },
        {
            "introduced": "13.5.1"
        },
        {
            "last_affected": "13.5.1"
        },
        {
            "introduced": "13.5.2"
        },
        {
            "last_affected": "13.5.2"
        },
        {
            "introduced": "14.3.0"
        },
        {
            "last_affected": "14.3.0"
        },
        {
            "introduced": "14.3.1"
        },
        {
            "last_affected": "14.3.1"
        },
        {
            "introduced": "15.1.0"
        },
        {
            "last_affected": "15.1.0"
        },
        {
            "introduced": "15.1.1"
        },
        {
            "last_affected": "15.1.1"
        }
    ]
}

Affected versions

10.*
10.7.0
12.*
12.3.0
12.3.1
12.3.2
12.3.3
12.3.4
12.3.5
12.3.6
13.*
13.5.0
13.5.1
13.5.2
14.*
14.3.0
14.3.1
15.*
15.1.0
15.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10761.json"