{"id":"GHSA-p572-p2rj-q5f4","summary":"Umbraco Forms components vulnerable to Stored Cross-site Scripting","details":"### Impact\nAuthenticated user that has access to edit Forms  may inject unsafe code into Forms components.\n\n### Patches\nIssue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).\n\n### References\nhttps://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024\nhttps://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024\nhttps://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes\nhttps://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values","aliases":["CVE-2024-35239"],"modified":"2026-02-03T03:14:12.795636Z","published":"2024-05-28T20:40:31Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-05-28T20:40:31Z","nvd_published_at":"2024-05-28T21:16:31Z","cwe_ids":["CWE-79"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35239"},{"type":"WEB","url":"https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values"},{"type":"WEB","url":"https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024"},{"type":"WEB","url":"https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes"},{"type":"WEB","url":"https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes#version-8"},{"type":"WEB","url":"https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco.Forms.Issues"}],"affected":[{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.0.1"}]}],"versions":["13.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p572-p2rj-q5f4/GHSA-p572-p2rj-q5f4.json"}},{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.2.2"}]}],"versions":["12.0.0","12.1.0","12.1.0-rc1","12.1.1","12.1.2","12.2.0","12.2.0-rc1","12.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p572-p2rj-q5f4/GHSA-p572-p2rj-q5f4.json"}},{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.5.3"}]}],"versions":["10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.1.0-rc001","10.1.1","10.1.2","10.1.3","10.2.0","10.2.0-rc001","10.2.1","10.2.2","10.2.3","10.2.4","10.3.0","10.3.0-rc001","10.3.1","10.3.2","10.3.3","10.4.0","10.4.0-rc1","10.5.0","10.5.0-rc1","10.5.1","10.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p572-p2rj-q5f4/GHSA-p572-p2rj-q5f4.json"}},{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.13.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p572-p2rj-q5f4/GHSA-p572-p2rj-q5f4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}]}