{"id":"GHSA-69cg-w8vm-h229","summary":"XSS/HTML Injection Vulnerability in Umbraco Preview Badge","details":"### Impact\n\nAuthenticated users are able to exploit an XSS vulnerability when viewing previewed content.\n\n### Patches\n\nWill be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2.\n\n### Workarounds\n\nNone available.","aliases":["CVE-2024-10761"],"modified":"2025-02-19T18:41:51.312794Z","published":"2025-01-21T21:24:20Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-01-21T21:24:20Z","nvd_published_at":null,"cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-69cg-w8vm-h229"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10761"},{"type":"WEB","url":"https://drive.google.com/file/d/1YoZgdlS3QT7Xu005j9RO-FFUT8RbB0Da/view?usp=sharing"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco-CMS"},{"type":"WEB","url":"https://vuldb.com/?ctiid.282930"},{"type":"WEB","url":"https://vuldb.com/?id.282930"},{"type":"WEB","url":"https://vuldb.com/?submit.427091"}],"affected":[{"package":{"name":"Umbraco.Cms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"13.5.3"}]}],"versions":["11.0.0","11.1.0","11.1.0-rc","11.2.0","11.2.0-rc","11.2.1","11.2.2","11.3.0","11.3.0-rc","11.3.1","11.4.0","11.4.0-rc","11.4.1","11.4.2","11.5.0","11.5.0-rc","12.0.0","12.0.0-rc1","12.0.0-rc2","12.0.0-rc3","12.0.0-rc4","12.0.0-rc5","12.0.1","12.1.0","12.1.0-rc","12.1.1","12.1.2","12.2.0","12.2.0-rc","12.3.0","12.3.0-rc","12.3.1","12.3.10","12.3.2","12.3.3","12.3.4","12.3.5","12.3.6","12.3.7","12.3.8","12.3.9","13.0.0","13.0.0-rc1","13.0.0-rc2","13.0.0-rc3","13.0.0-rc4","13.0.0-rc5","13.0.1","13.0.2","13.0.3","13.1.0","13.1.0-rc","13.1.1","13.2.0","13.2.0-rc","13.2.1","13.2.2","13.3.0","13.3.0-rc","13.3.1","13.3.2","13.4.0","13.4.0-rc","13.4.0-rc2","13.4.1","13.5.0","13.5.0-rc","13.5.1","13.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.3.2"}]}],"versions":["14.0.0","14.1.0","14.1.0-rc","14.1.0-rc2","14.1.1","14.1.2","14.2.0","14.2.0-rc","14.2.0-rc2","14.2.0-rc3","14.3.0","14.3.0-rc","14.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.1.2"}]}],"versions":["15.0.0","15.1.0","15.1.0-rc","15.1.0-rc2","15.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.8.7"},{"fixed":"10.8.8"}]}],"versions":["10.8.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms.Web.Common","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"13.5.3"}]}],"versions":["11.0.0","11.1.0","11.1.0-rc","11.2.0","11.2.0-rc","11.2.1","11.2.2","11.3.0","11.3.0-rc","11.3.1","11.4.0","11.4.0-rc","11.4.1","11.4.2","11.5.0","11.5.0-rc","12.0.0","12.0.0-rc1","12.0.0-rc2","12.0.0-rc3","12.0.0-rc4","12.0.0-rc5","12.0.1","12.1.0","12.1.0-rc","12.1.1","12.1.2","12.2.0","12.2.0-rc","12.3.0","12.3.0-rc","12.3.1","12.3.10","12.3.2","12.3.3","12.3.4","12.3.5","12.3.6","12.3.7","12.3.8","12.3.9","13.0.0","13.0.0-rc2","13.0.0-rc3","13.0.0-rc4","13.0.0-rc5","13.0.1","13.0.2","13.0.3","13.1.0","13.1.0-rc","13.1.1","13.2.0","13.2.0-rc","13.2.1","13.2.2","13.3.0","13.3.0-rc","13.3.1","13.3.2","13.4.0","13.4.0-rc","13.4.0-rc2","13.4.1","13.5.0","13.5.0-rc","13.5.1","13.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms.Web.Common","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.3.2"}]}],"versions":["14.0.0","14.1.0","14.1.0-rc","14.1.0-rc2","14.1.1","14.1.2","14.2.0","14.2.0-rc","14.2.0-rc2","14.2.0-rc3","14.3.0","14.3.0-rc","14.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms.Web.Common","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.1.2"}]}],"versions":["15.0.0","15.1.0","15.1.0-rc","15.1.0-rc2","15.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}},{"package":{"name":"Umbraco.Cms.Web.Common","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.8.7"},{"fixed":"10.8.8"}]}],"versions":["10.8.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-69cg-w8vm-h229/GHSA-69cg-w8vm-h229.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}