5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-49279

GHSA ID

GHSA-6xmx-85x3-4cv2

EPSS Score

0.6253%

CWE

CWE-79

Published

12/13/2023

Updated

12/13/2023

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-49279

CVE-2023-49279: Stored XSS via SVG File Upload

Impact

A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround

Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

Serve all media from an different host (e.g cdn) that where umbraco is hosted

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-49279

CVE-2023-49279:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-49279

GHSA ID

GHSA-6xmx-85x3-4cv2

EPSS Score

0.6253%

CWE

CWE-79

Published

12/13/2023

Updated

12/13/2023

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.CMS	nuget	>= 7.0.0, < 7.15.11	7.15.11
Umbraco.CMS	nuget	>= 8.0.0, < 8.18.9	8.18.9
Umbraco.CMS	nuget	>= 9.0.0, < 10.7.0	10.7.0
Umbraco.CMS	nuget	>= 11.0.0, < 11.5.0	11.5.0
Umbraco.CMS	nuget	>= 12.0.0, < 12.2.0	12.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-49279: Stored XSS via SVG File Upload

Impact

Workaround

CVE-2023-49279:

5.4

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2023-49279: Stored XSS via SVG File Upload

Impact

Workaround

Basic Information

Basic Information

Technical Details

5.4

5.4

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI