CVE-2024-55488

23th percentile - higher than 23% of all known CVEs

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.

The risk for the organization is limited because the exploit requires an authenticated user with access to the CMS. If such a user's account is compromised, an attacker can inject malicious code, potentially leading to session data theft or website defacement.

It is recommended to restrict access to the Umbraco CMS admin panel to trusted users only and implement additional security measures such as Content Security Policy (CSP) and server-side input validation.