Umbraco Forms components vulnerable to Stored Cross-site Scripting
Low severity
GitHub Reviewed
Published
May 28, 2024
in
umbraco/Umbraco.Forms.Issues
•
Updated Jun 5, 2024
Package
Affected versions
>= 13.0.0, < 13.0.1
>= 12.0.0, < 12.2.2
>= 10.0.0, < 10.5.3
>= 8.0.0, < 8.13.13
Patched versions
13.0.1
12.2.2
10.5.3
8.13.13
Description
Published to the GitHub Advisory Database
May 28, 2024
Reviewed
May 28, 2024
Published by the National Vulnerability Database
May 28, 2024
Last updated
Jun 5, 2024
Credits
-
RaphaelCSSilva Reporter
Impact
Authenticated user that has access to edit Forms may inject unsafe code into Forms components.
Patches
Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
References
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
References