CVE-2024-35218
- Source
- https://cve.org/CVERecord?id=CVE-2024-35218
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35218.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-35218
- Aliases
- Published
- 2024-05-21T13:42:27.260Z
- Modified
- 2026-07-15T01:49:16.098943168Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
- Details
-
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35218.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35218.json
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w
- https://nvd.nist.gov/vuln/detail/CVE-2024-35218
- https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385
- https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6
- https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba
- https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050
Affected packages
Git / github.com/umbraco/umbraco-cms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/umbraco/umbraco-cms
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "8.18.13" }, { "introduced": "10.0.0" }, { "fixed": "10.8.4" }, { "introduced": "12.0.0" }, { "fixed": "12.3.7" }, { "introduced": "13.0.0" }, { "fixed": "13.1.1" } ] }