CVE-2024-55488 Cross-site scripting in n/a
Authenticated users with specific CMS access can inject scripts, potentially leading to code execution or account takeover, though the vendor disputes this as intended behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55488?
CVE-2024-55488 is a medium-severity cross-site scripting vulnerability in Umbraco Umbraco Cms, published on 22 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.
Weakness: CWE-79
Which versions are affected by CVE-2024-55488?
It affects 1 product.
Products include Umbraco Umbraco Cms.
How do I fix CVE-2024-55488?
No fix has been published for CVE-2024-55488 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-55488 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55488 exists.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users