← CVE Intelligence

CVE-2023-38694

Umbraco CMS vulnerable to possible injection of HTML in an unintended form PUBLISHED

Description (CNA)

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.

Affected (CNA)

Vendor / productVersions
umbraco / Umbraco-CMSaffected >= 8.0.0, < 8.18.10; affected >= 9.0.0-rc001, < 10.7.0; affected >= 11.0.0-rc1, < 12.1.0

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.