{"id":"CVE-2018-17256","aliases":["EUVD-2022-5635","GHSA-wrrj-r2j4-969w"],"status":"published","title":"Umbraco CMS vulnerable to stored XSS","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00651,"percentile":0.51476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-11-27T19:29:00.197Z","modified":"2026-10-24T10:30:51Z","affected":[{"source":"ghsa","ecosystem":"NuGet","package":"umbraco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.12.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"umbraco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.12.3"}]}],"versions":["5.0.1000","5.0.1000.1","5.0.310","5.0.310.1","5.1.0.161-rc","5.1.0.175","5.2.0-beta"]}],"products":[{"vendor":"cybersecurity philippines - cert","product":"umbracocms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17256","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wrrj-r2j4-969w"},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-17256","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2018-11-27T21:00:00Z","modified":"2024-09-17T04:08:55.751Z","updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2022-5635","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2018-11-27T21:00:00Z","modified":"2024-09-17T04:08:55Z","updated_at":"2026-11-03T00:28:25.709658Z"}],"ghsa":[{"id":"GHSA-wrrj-r2j4-969w","title":"Umbraco CMS vulnerable to stored XSS","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2022-05-14T01:44:31Z","modified":"2023-07-24T20:54:52Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2018-17256","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2018-11-27T19:29:00.197Z","modified":"2026-06-17T01:45:36.21Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-17256","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2018-11-27T19:29:00.197Z","modified":"2026-10-24T10:30:51.691672629Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"GHSA-wrrj-r2j4-969w","title":"Umbraco CMS vulnerable to stored XSS","description":"Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.","status":"published","published":"2022-05-14T01:44:31Z","modified":"2024-02-16T08:04:28.706152Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}