CVE-2024-10761 Umbraco CMS Dashboard frame cross site scripting
Remote attackers can execute arbitrary scripts via the culture parameter in the Umbraco CMS Dashboard preview frame, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-10761?
CVE-2024-10761 is a medium-severity cross-site scripting vulnerability in Umbraco Umbraco Cms, published on 4 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component.
Which versions are affected by CVE-2024-10761?
16 open source packages ship an affected version, including Umbraco.Cms and Umbraco.Cms.Web.Common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Cms NuGet | From 10.8.7 | 10.8.8 |
Umbraco.Cms NuGet | From 10.8.7 | 10.8.8 |
Umbraco.Cms NuGet | From 11.0.0 | 13.5.3 |
Umbraco.Cms NuGet | From 11.0.0 | 13.5.3 |
Umbraco.Cms NuGet | From 14.0.0 | 14.3.2 |
Umbraco.Cms NuGet | From 14.0.0 | 14.3.2 |
10 more packages
Umbraco.Cms NuGet | From 15.0.0 | 15.1.2 |
Umbraco.Cms NuGet | From 15.0.0 | 15.1.2 |
Umbraco.Cms.Web.Common NuGet | From 10.8.7 | 10.8.8 |
Umbraco.Cms.Web.Common NuGet | From 10.8.7 | 10.8.8 |
Umbraco.Cms.Web.Common NuGet | From 11.0.0 | 13.5.3 |
Umbraco.Cms.Web.Common NuGet | From 11.0.0 | 13.5.3 |
Umbraco.Cms.Web.Common NuGet | From 14.0.0 | 14.3.2 |
Umbraco.Cms.Web.Common NuGet | From 14.0.0 | 14.3.2 |
Umbraco.Cms.Web.Common NuGet | From 15.0.0 | 15.1.2 |
Umbraco.Cms.Web.Common NuGet | From 15.0.0 | 15.1.2 |
Products include Umbraco Umbraco Cms.
How do I fix CVE-2024-10761?
Upgrade Umbraco.Cms to a fixed version for your release line: 10.8.8, 13.5.3, 14.3.2 or 15.1.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-10761 being exploited?
There is no known exploitation of CVE-2024-10761 in the wild and no public exploit code.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Sources
Also known as GHSA-69cg-w8vm-h229.