Impact Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application.

Affected versions Umbraco CMS >= 8.00

Patches This is fixed in 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer

Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed.

Affected Version

\>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0

Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1

Impact A brute force exploit that can be used to collect valid usernames is possible.

Explanation of the vulnerability It's a brute force exploit that can be used to collect valid usernames by using the “forgot password” function when trying to log into the Backoffice. If the username/email is known, it is easier to find the corresponding password. If an email address that was already used and registered by a user, is provided as an input, the server internal processing time takes longer. If the email address does not exist in the database of the registered users, the server would respond immediately.

Impact Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.

Explanation of the vulnerability The “Package” section in Umbraco Backoffice allows a logged in user to write folders outside of the default package directory.

Impact Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application.

Explanation of the vulnerability

A DOM-XSS can be exploited when users are successfully logging into the Backoffice.

Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

Impact Users with low privileges ( Editor, etc) are able to access some unintended endpoints.

Explanation of the vulnerability Possible to delete redirect urls, when disabled by admin with only access to backoffice Possible to access the examine dashboard with only access to backoffice Possible to access the published cache dashboard with only access to backoffice Possible to access the telemetry dashboard with only access to backoffice Possible to access the languages with only access to backoffice Possible to access the stylesheets with only access to backoffice

Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled

Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.