Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Description

This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content.

Recommendation

Update the @umbraco-cms/backoffice package to the latest compatible version. Followings are version details:

• Affected version(s): >= 14.0.0, < 14.3.1
• Patched version(s): 14.3.1

References

• GHSA-c5g6-6xf7-qxp3
• CVE-2024-47819
• CWE-79
• CWE-80
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting - CVE-2024-9148
• metascraper before v5.2.0 vulnerable to stored cross-site scripting - CVE-2018-3773
• Dash apps vulnerable to Cross-site Scripting - dash-core-components - CVE-2024-21485
• Dash apps vulnerable to Cross-site Scripting - CVE-2024-21485

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@umbraco-cms/backoffice