GHSA-rpj9-xjwm-wr6w

Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-35240

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Umbraco.Commerce	>= 12.0.0, < 12.1.4	12.1.4
NuGet	Umbraco.Commerce	< 10.0.5	10.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Stored Cross-site scripting (XSS) enable attackers to inject malicious code into Print Functionality ### Patches 12.1.4, 10.0.5 ### References https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023

References

External links from the advisory. They lead to third-party sites.

https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w web
https://nvd.nist.gov/vuln/detail/CVE-2024-35240 advisory
https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023 web
https://github.com/umbraco/Umbraco.Commerce.Issues package