Back to Database
Status published
Medium
CVE-2024-35218
Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
Vulnerability Description
Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35218
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w
- https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385
- https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6
- https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba
- https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050
More from umbraco
View All →CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
Medium
4.9
CVE-2025-54425
Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
Medium
5.3
CVE-2025-49147
Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
Medium
5.3
CVE-2025-48953
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Medium
5.5
CVE-2025-47280
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Low
2.3
Affected Vendor
umbraco
View all reports →Affected Software
Umbraco-CMS
Vulnerable Versions:
>= 8.0.0, < 8.18.13, >= 10.0.0, < 10.8.4, >= 12.0.0, < 12.3.7, >= 13.0.0, < 13.1.1
Timeline
Official Publish:
May 21st, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N