GHSA-rpj9-xjwm-wr6w: Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

Skip to content

Navigation Menu

Sign in

CVE-2024-35240

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Resources

  • Learning Pathways
  • White papers, Ebooks, Webinars
  • Customer Stories
  • Partners

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches****Use saved searches to filter your results more quickly

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-35240

Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

Moderate severity GitHub Reviewed Published May 28, 2024 in umbraco/Umbraco.Commerce.Issues • Updated May 28, 2024

Vulnerability details Dependabot alerts 0

Package

nuget Umbraco.Commerce (NuGet)

Affected versions

>= 12.0.0, < 12.1.4

< 10.0.5

Patched versions

12.1.4

10.0.5

Description

Impact

Stored Cross-site scripting (XSS) enable attackers to inject malicious code into Print Functionality

Patches

12.1.4, 10.0.5

References

https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023

References

• GHSA-rpj9-xjwm-wr6w
• https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023

netcamo published to umbraco/Umbraco.Commerce.Issues

May 28, 2024

Published to the GitHub Advisory Database

May 28, 2024

Reviewed

May 28, 2024

Last updated

May 28, 2024

Severity

Moderate

5.4

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-79

CVE ID

CVE-2024-35240

GHSA ID

GHSA-rpj9-xjwm-wr6w

Source code

umbraco/Umbraco.Commerce.Issues

Checking history

See something to contribute? Suggest improvements for this vulnerability.