{"id":"CVE-2024-47819","aliases":["EUVD-2024-3012","GHSA-c5g6-6xf7-qxp3"],"status":"published","title":"Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section","description":"Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2024-10-22T15:25:03Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"NuGet","package":"Umbraco.Cms.StaticAssets","fixed_in":["14.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@umbraco-cms/backoffice","fixed_in":["14.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.StaticAssets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.3.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@umbraco-cms/backoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.3.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.StaticAssets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.3.1"}]}],"versions":["14.0.0","14.1.0","14.1.0-rc","14.1.0-rc2","14.1.1","14.1.2","14.2.0","14.2.0-rc","14.2.0-rc2","14.2.0-rc3","14.3.0","14.3.0-rc"]},{"source":"osv","ecosystem":"npm","package":"@umbraco-cms/backoffice","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.3.1"}]}]}],"products":[{"vendor":"umbraco","product":"umbraco-cms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-c5g6-6xf7-qxp3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47819","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c5g6-6xf7-qxp3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47819.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-47819","title":"Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section","description":"Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.","status":"published","published":"2024-10-22T15:25:03.501Z","modified":"2024-10-22T15:55:27.159Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:57.638551Z"}],"euvd":[{"id":"EUVD-2024-3012","description":"Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.","status":"published","published":"2024-10-22T15:25:03Z","modified":"2024-10-22T15:55:27Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:22.720016Z"}],"ghsa":[{"id":"GHSA-c5g6-6xf7-qxp3","title":"Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section","description":"### Impact\nThis can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content.\n\n### Patches\nWill be patched in 14.3.1 and 15.0.0.\n\n### Workarounds\nEnsure that access to the Dictionary section is only granted to trusted users.\n\n","status":"published","published":"2024-10-22T17:50:08Z","modified":"2024-10-22T19:22:20Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2024-47819","description":"Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.","status":"published","published":"2024-10-22T16:15:07.5Z","modified":"2026-06-17T07:57:48.68Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:33.928543Z"}],"osv":[{"id":"CVE-2024-47819","title":"Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section","description":"Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users.","status":"published","published":"2024-10-22T15:25:03.501Z","modified":"2026-10-28T02:30:59.92098144Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-c5g6-6xf7-qxp3","title":"Umbraco CMS vulnerable to stored Cross-site Scripting in the \"dictionary name\" on Dictionary section","description":"### Impact\nThis can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content.\n\n### Patches\nWill be patched in 14.3.1 and 15.0.0.\n\n### Workarounds\nEnsure that access to the Dictionary section is only granted to trusted users.\n\n","status":"published","published":"2024-10-22T17:50:08Z","modified":"2024-10-22T19:32:47.036714Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}