Umbraco CMS vulnerable to stored XSS via SVG File Upload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- umbraco Umbraco-CMS
From 7.0.0 · fixed in 7.15.11; From 8.0.0 · fixed in 8.18.9; From 9.0.0-rc001 · fixed in 10.7.0; From 11.0.0-rc1 · fixed in 11.5.0; From 12.0.0-rc1 · fixed in 12.2.0
- Umbraco.CMSNuGet
From 7.0.0 · fixed in 7.15.11
- Umbraco.CMSNuGet
From 8.0.0 · fixed in 8.18.9
- Umbraco.CMSNuGet
From 9.0.0 · fixed in 10.7.0
- Umbraco.CMSNuGet
From 11.0.0 · fixed in 11.5.0
- Umbraco.CMSNuGet
From 12.0.0 · fixed in 12.2.0