CVE-2023-48313: Umbraco contains a DOM-XSS
Impact Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application.
Explanation of the vulnerability
A DOM-XSS can be exploited when users are successfully logging into the Backoffice.
Other sources
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48313?
CVE-2023-48313 is rated as a critical vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2023-48313?
To fix CVE-2023-48313, upgrade Umbraco.CMS to version 12.3.4 or 10.8.1.
What software is affected by CVE-2023-48313?
CVE-2023-48313 affects Umbraco CMS versions between 11.0.0 and 12.3.4 and versions between 10.0.0 and 10.8.1.
Can CVE-2023-48313 be exploited remotely?
Yes, CVE-2023-48313 can be exploited remotely by attackers through crafted payloads.
What are the consequences of CVE-2023-48313?
Exploitation of CVE-2023-48313 can lead to unauthorized access and the ability to execute malicious scripts in the context of the user’s browser.