Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

GHSA ID

GHSA-rpj9-xjwm-wr6w

CVE ID

CVE-2024-35240

Severity

medium

Published

2024-05-28T21:18:04Z

Updated

2024-06-05T13:12:57Z

CVSS

5.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS v3

5.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Description

CWEs

• CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

• https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w ↗
• https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023 ↗
• https://nvd.nist.gov/vuln/detail/CVE-2024-35240 ↗
• https://github.com/advisories/GHSA-rpj9-xjwm-wr6w ↗