CVE-2024-10761: Umbraco CMS Dashboard frame cross site scripting
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-69cg-w8vm-h229. This link is maintained to preserve external references.
Original Description
A vulnerability was found in Umbraco CMS 12.3.6. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Other sources
Impact
Authenticated users are able to exploit an XSS vulnerability when viewing previewed content.
Patches
Will be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2.
Workarounds
None available.
— GitHub
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10761?
CVE-2024-10761 has been classified as problematic due to potential cross-site scripting vulnerabilities.
How do I fix CVE-2024-10761?
To mitigate CVE-2024-10761, upgrade Umbraco CMS to a version beyond 12.3.6.
What components are affected by CVE-2024-10761?
CVE-2024-10761 specifically affects the Dashboard component in Umbraco CMS version 12.3.6.
What type of vulnerability is CVE-2024-10761?
CVE-2024-10761 is a cross-site scripting (XSS) vulnerability.
Where can I find more information about CVE-2024-10761?
For more details about CVE-2024-10761, consult the official vulnerability databases or GitHub advisories.