CVE-2024-55488
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.
Risk Assessment
The risk for the organization is limited because the exploit requires an authenticated user with access to the CMS. If such a user's account is compromised, an attacker can inject malicious code, potentially leading to session data theft or website defacement.
Recommendation
It is recommended to restrict access to the Umbraco CMS admin panel to trusted users only and implement additional security measures such as Content Security Policy (CSP) and server-side input validation.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.