CVE-2023-48313
Umbraco contains a DOM-XSS
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Umbraco contains a DOM-XSS
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-48313- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-3302
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
- Record
EUVD-2023-3302- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v98m-398x-269r
DOM-XSS on Backoffice login screen.
Impact
Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application.
Explanation of the vulnerability
A DOM-XSS can be exploited when users are successfully logging into the Backoffice.
- Record
GHSA-v98m-398x-269r- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-48313- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Umbraco contains a DOM-XSS
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-48313- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-v98m-398x-269r
DOM-XSS on Backoffice login screen.
Impact
Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application.
Explanation of the vulnerability
A DOM-XSS can be exploited when users are successfully logging into the Backoffice.
- Record
GHSA-v98m-398x-269r- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.CMSNuGet |
10.0.0 up to 10.8.1 | 10.8.1 |
Umbraco.CMSNuGet |
11.0.0 up to 12.3.4 | 12.3.4 |
Umbraco.CMSNuGet |
10.0.0 up to 10.8.1, plus listed versions 10.0.110.1.010.1.0-rc10.1.0-rc210.1.1 Show 21 moreShow less10.2.010.2.0-rc10.2.110.3.010.3.0-rc10.3.110.3.210.4.010.4.0-rc10.4.110.4.210.5.010.5.0-rc10.5.110.6.010.6.0-rc10.6.110.7.010.7.0-rc10.8.010.8.0-rc |
10.8.1 |
Umbraco.CMSNuGet |
11.0.0 up to 12.3.4, plus listed versions 11.1.011.1.0-rc11.2.011.2.0-rc11.2.1 Show 28 moreShow less11.2.211.3.011.3.0-rc11.3.111.4.011.4.0-rc11.4.111.4.211.5.011.5.0-rc12.0.012.0.0-rc112.0.0-rc212.0.0-rc312.0.0-rc412.0.0-rc512.0.112.1.012.1.0-rc12.1.112.1.212.2.012.2.0-rc12.3.012.3.0-rc12.3.112.3.212.3.3 |
12.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-48313 is a medium vulnerability (CVSS 4.3) in Umbraco Cms, published December 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in Umbraco.CMS 10.8.1.