{"id":"CVE-2024-35218","aliases":["EUVD-2024-1633","GHSA-gvpc-3pj6-4m9w"],"status":"published","title":"Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane","description":"Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00354,"percentile":0.29341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-05-21T13:42:27Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"NuGet","package":"UmbracoCms.Core","fixed_in":["8.18.13","10.8.4","12.3.7","13.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.18.13"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.8.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.1.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.18.13"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.10.0","8.10.0-rc","8.10.1","8.10.2","8.10.3","8.11.0","8.11.0-rc","8.11.1","8.11.2","8.11.3","8.12.0","8.12.0-rc","8.12.1","8.12.2","8.12.3","8.13.0","8.13.0-rc","8.13.1","8.14.0","8.14.0-rc","8.14.1","8.14.2","8.14.3","8.14.4","8.15.0","8.15.0-rc","8.15.1","8.15.2","8.15.3","8.16.0","8.16.0-rc","8.17.0","8.17.0-rc","8.17.0-rc2","8.17.1","8.17.2","8.18.0","8.18.0-rc","8.18.0-rc2","8.18.1","8.18.10","8.18.11","8.18.12","8.18.2","8.18.3","8.18.4","8.18.5","8.18.6","8.18.7","8.18.8","8.18.9","8.2.0","8.2.0-rc","8.2.1","8.2.2","8.2.3","8.3.0","8.3.1","8.4.0","8.4.0-rc","8.4.1","8.4.2","8.5.0","8.5.1","8.5.2","8.5.3","8.5.4","8.5.5","8.6.0","8.6.0-rc","8.6.1","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.7.0","8.7.0-rc","8.7.1","8.7.2","8.7.3","8.8.0","8.8.0-rc","8.8.1","8.8.2","8.8.3","8.8.4","8.9.0","8.9.0-rc","8.9.1","8.9.2","8.9.3"]},{"source":"osv","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.8.4"}]}]},{"source":"osv","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"UmbracoCms.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.1.1"}]}]}],"products":[{"vendor":"umbraco","product":"umbraco-cms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-gvpc-3pj6-4m9w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35218","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gvpc-3pj6-4m9w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35218.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-35218","title":"Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane","description":"Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.\n\n\n\n\n","status":"published","published":"2024-05-21T13:42:27.26Z","modified":"2024-08-02T03:07:46.766Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1633","description":"Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.\n\n\n\n\n","status":"published","published":"2024-05-21T13:42:27Z","modified":"2024-08-02T03:07:46Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-gvpc-3pj6-4m9w","title":"Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane","description":"### Impact\nStored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application.\n\n### Affected versions\nUmbraco CMS \u003e= 8.00\n\n### Patches\nThis is fixed in 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer","status":"published","published":"2024-05-21T14:47:24Z","modified":"2025-02-12T18:33:38Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2024-35218","description":"Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.\n\n\n\n\n","status":"published","published":"2024-05-21T14:15:12.003Z","modified":"2026-06-17T07:34:33.917Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"CVE-2024-35218","title":"Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane","description":"Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.\n\n\n\n\n","status":"published","published":"2024-05-21T13:42:27.26Z","modified":"2026-10-28T02:30:46.085824673Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-gvpc-3pj6-4m9w","title":"Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane","description":"### Impact\nStored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application.\n\n### Affected versions\nUmbraco CMS \u003e= 8.00\n\n### Patches\nThis is fixed in 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer","status":"published","published":"2024-05-21T14:47:24Z","modified":"2026-09-10T03:50:02.845381788Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}