Medium severity · published May 28, 2024
CVE-2024-35239
Umbraco Commerce is an open source dotnet web forms solution
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
Umbraco Forms · Umbraco
before 8.13.13; 9.0.0 before 10.5.3; 11.0.0 before 12.2.2; 13.0.0 before 13.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35239
Product
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
Release Notes
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
Release Notes
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
Release Notes
https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
Vendor Advisory
https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4
More from Umbraco Forms
9.8
CVE-2021-33224
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file
7.5
CVE-2025-68924
In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution
7.5
CVE-2020-7685
This affects all versions of package UmbracoForms
6.5
CVE-2026-24687
Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
6.1
CVE-2025-47280
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow