CVE-2024-35240 MEDIUM

CVE-2024-35240: Stored Cross-site Scripting on Print Functionality in Umbraco Commerce

Vendor Umbraco
Product Umbraco.Commerce.Issues
Weakness CWE-79 · XSS
Published May 28, 2024
Last update August 19, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

May 28, 2024 CVE published
August 19, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-5238 YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVE-2026-3996 WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2023-47835 WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS) CVE-2014-125039 kkokko NeoXplora Trainer cross site scripting CVE-2023-2184 WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site Scripting