Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-48927

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.

Published

2024-10-22T16:15:08.360

Last Modified

2024-10-25T16:15:13.327

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.6 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-74
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application umbraco umbraco_cms < 8.18.15 Yes
Application umbraco umbraco_cms < 10.8.7 Yes
Application umbraco umbraco_cms < 13.5.2 Yes
References