--- title: "CVE-2024-35218" date: "2024-09-23T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-35218/" --- # CVE-2024-35218 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Feb 6, 2024 CVE-2024-35218 **Published:** Sep 23, 2024 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 4.2 Medium Severity markdown Stored-XSS umbraco XSS RS Raphael Silva Reported by Checkmarx Zero Details Overview ## Summary The package `@umbraco/Umbraco-CMS` contains a stored XSS vulnerability in the Content page through the Markdown Editor’s preview pane. The vulnerability allows an attacker with Editor permissions to inject arbitrary JavaScript into the markdown content. When an administrator previews or publishes this page, the XSS is triggered, potentially compromising the web application. This can lead to privilege escalation and full compromise of the application. The issue was fixed by introducing HTML sanitization in the preview pane. ## Product This vulnerability affects `@umbraco/Umbraco-CMS` versions prior to 8.18.13, 10.8.4, 12.3.7 and 13.1.1. ## Impact This vulnerability can lead to the execution of arbitrary JavaScript in the administrator’s browser. A malicious editor can submit a page for review containing injected JavaScript, which when viewed by an administrator, can trigger XSS and result in a full application compromise. ## Steps to reproduce 1. Log in as an Editor and navigate to a Content page with a markdown editor and preview pane enabled. 2. Inject arbitrary JavaScript into the markdown content. 3. Submit the page for review. 4. Log in as an Administrator and preview the page via the following URL: `/umbraco/#/content/content/edit/`. 5. The XSS is triggered. ### Expected result: The XSS is triggered, and the malicious JavaScript is executed in the administrator’s browser. ## Remediation The issue was fixed by sanitizing HTML content before rendering it in the preview pane of the markdown editor. This prevents stored XSS from being triggered in the administrator’s session. The fix was applied in the following versions: - 8.18.13 - 10.8.4 - 12.3.7 - 13.1.1 ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/). ## Resources 1. [GHSA-gvpc-3pj6-4m9w](https://github.com/advisories/GHSA-gvpc-3pj6-4m9w) 2. [CVE-2024-35218](https://nvd.nist.gov/vuln/detail/CVE-2024-35218) 3. [Fix commit 1](https://github.com/umbraco/Umbraco-CMS/commit/1b712fe6ec52aa4e71b3acf63e393c8e6ab85385) 4. [Fix commit 2](https://github.com/umbraco/Umbraco-CMS/commit/a2684069b1e9976444f60b4b37a80be05b87f6b6) 5. [Fix commit 3](https://github.com/umbraco/Umbraco-CMS/commit/cbf9f9bcd199d7ca0412be3071d275556f10b7ba) 6. [Fix commit 4](https://github.com/umbraco/Umbraco-CMS/commit/d090176272d07500dac0daee7c598aa8bb321050) 0 Medium Severity CVSS v3.1 Score 4.2 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None Advisory Timeline1. Discovered Sep 20, 2023 2. Disclosed Nov 6, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Feb 6, 2024 A commit was released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)