GHSA-wv8v-rmw2-25wcMediumCVSS 4.6

XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Published
January 21, 2025
Last Modified
January 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-24012 →

📋 Description

Impact

Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components.

Patches

Will be patched in 14.3.2 and 15.1.2.

Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil

🎯 Affected products4

  • nuget/Umbraco.Cms.StaticAssets:>= 14.0.0, < 14.3.2
  • nuget/Umbraco.Cms.StaticAssets:>= 15.0.0, < 15.1.2
  • npm/@umbraco-cms/backoffice:>= 14.0.0, < 14.3.2
  • npm/@umbraco-cms/backoffice:>= 15.0.0, < 15.1.2

🔗 References (4)