CVE-2024-35218mediumCWE-79

CVE-2024-35218: falha de média gravidade em Umbraco-CMS

Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Umbraco-CMS+ Monitorar UmbracoCms.Core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.2epss 0.4%
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
umbraco · Umbraco-CMS
CVEs relacionadas — Umbraco-CMS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-24011MEDIUMUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesEPSS 1.6%CVE-2023-37267HIGHUmbraco allows possible Admin-level access to backoffice without Auth under rare conditionsEPSS 0.7%CVE-2026-69197HIGHUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionEPSS 0.7%CVE-2025-32017HIGHUmbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersEPSS 0.6%CVE-2023-49089HIGHUmbraco CMS possible path traversal when creating packages from backofficeEPSS 0.6%CVE-2023-49278MEDIUMUmbraco CMS brute force exploit can be used to collect valid usernamesEPSS 0.5%