{"id":"CVE-2024-55488","aliases":["EUVD-2024-52775","GHSA-572q-86rr-5vgq"],"status":"disputed","title":"Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting","description":"A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00332,"percentile":0.26596,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-01-22T00:00:00Z","modified":"2026-10-28T02:31:10Z","products":[{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scripting-in-umbraco-rich-text-display/","tags":["Exploit","Third Party Advisory","advisory"]},{"url":"https://docs.umbraco.com/umbraco-cms/develop-with-umbraco/templating-and-rendering/design/stylesheets-javascript","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55488","tags":["advisory"]},{"url":"https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scripting-in-umbraco-rich-text-display","tags":["web"]},{"url":"http://umbraco.com","tags":["web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/pull/17164","tags":["web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-15.0.0-rc1","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/5270","tags":["web"]},{"url":"https://github.com/advisories/GHSA-572q-86rr-5vgq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55488.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-55488","description":"A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.","status":"disputed","published":"2025-01-22T00:00:00Z","modified":"2026-07-05T14:30:50.471Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2024-52775","description":"A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-07-05T14:30:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:14.2986Z"}],"ghsa":[{"id":"GHSA-572q-86rr-5vgq","title":"Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting","description":"# Withdrawn Advisory\nThis advisory has been withdrawn because the issue is a [documented security](https://docs.umbraco.com/umbraco-cms/reference/security/serverside-sanitizing). This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5270.\n\n# Original Advisory\nA stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"withdrawn","published":"2025-01-22T18:31:55Z","modified":"2025-02-13T16:44:46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2024-55488","description":"A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.","status":"disputed","published":"2025-01-22T16:15:29.77Z","modified":"2026-07-05T15:16:54.9Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:42.895329Z"}],"osv":[{"id":"CVE-2024-55488","description":"A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-10-28T02:31:10.85661788Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"GHSA-572q-86rr-5vgq","title":"Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting","description":"# Withdrawn Advisory\nThis advisory has been withdrawn because the issue is a [documented security](https://docs.umbraco.com/umbraco-cms/reference/security/serverside-sanitizing). This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5270.\n\n# Original Advisory\nA stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","status":"withdrawn","published":"2025-01-22T18:31:55Z","modified":"2026-09-10T03:50:56.774053982Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}