Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Description

This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content.

Recommendation

Update the @umbraco-cms/backoffice package to the latest compatible version. Followings are version details:

• Affected version(s): >= 14.0.0, < 14.3.1
• Patched version(s): 14.3.1

References

• GHSA-c5g6-6xf7-qxp3
• CVE-2024-47819
• CWE-79
• CWE-80
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6