medium5.4
CVE-2024-35240
Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality
Impact
### Impact Stored Cross-site scripting (XSS) enable attackers to inject malicious code into Print Functionality ### Patches 12.1.4, 10.0.5 ### References https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Commerce | >= 12.0.0, < 12.1.4 | 12.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023
- https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w
- https://github.com/advisories/GHSA-rpj9-xjwm-wr6w
- https://nvd.nist.gov/vuln/detail/CVE-2024-35240