« Volver al listado

CVE-2018-17256

Estado: ModificadaMedia (4.8)—

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Umbraco — Umbraco CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-17256",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@cspcert.ph",
      "affectedData": [
        {
          "vendor": "CyberSecurity Philippines - CERT",
          "product": "UmbracoCMS",
          "versions": [
            {
              "status": "affected",
              "version": "7.12.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-27T19:29:00.197",
  "references": [
    {
      "url": "https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vulnerability@cspcert.ph"
    },
    {
      "url": "https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Cross-Site Scripting (XSS) persistente en Umbraco CMS 7.12.3 permite que usuarios autenticados inyecten scripts web arbitrarios mediante el nombre de cabecera de un contenido (Blog, Content Page, etc.). La vulnerabilidad se explota al actualizar o eliminar el acceso público a un contenido."
    }
  ],
  "lastModified": "2026-06-17T01:45:36.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:umbraco:umbraco_cms:7.12.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6ACB8626-6DD7-4CDE-8789-7E6E3BE6BC20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@cspcert.ph"
}