--- title: "CVE-2024-35239" date: "2024-09-23T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-35239/" --- # CVE-2024-35239 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Jan 16, 2024 CVE-2024-35239 **Published:** Sep 23, 2024 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2.7 Low Severity forms Stored-XSS umbraco XSS RS Raphael Silva Reported by Checkmarx Zero Details Overview ## Summary The `Umbraco Forms` package contains a stored XSS vulnerability in the `Title and Description` component. Users with access to edit forms can inject arbitrary JavaScript into the `BodyText` and `CaptionTag` fields, which are rendered as HTML when the form is displayed. This vulnerability allows the execution of arbitrary JavaScript when the form is rendered. ## Product This vulnerability affects the `Umbraco Forms` package prior to versions 13.0.1, 12.2.2, 10.5.3 and 8.13.13. ## Impact An attacker with access to edit a form can inject arbitrary JavaScript into the `BodyText` or `CaptionTag` fields. When the form is rendered, the JavaScript executes in the browser, potentially allowing attackers to steal sensitive information or manipulate content in the context of the victim. ## Steps to reproduce 1. Log in as a user with permission to edit a form in Umbraco Forms. 2. Inject malicious JavaScript into the `BodyText` or `CaptionTag` fields of the `Title and Description` component. 3. Render the form to trigger the XSS. ### Expected result: The XSS is triggered, and the malicious JavaScript is executed in the context of the user viewing the form. ## Remediation The issue was fixed by sanitizing HTML content before rendering it, as well as adding an option for the developer to allow unsafe HTML in the form. The fix was applied in the following versions: - 13.0.1 - 12.2.2 - 10.5.3 - 8.13.13 ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/). ## Resources 1. [GHSA-p572-p2rj-q5f4](https://github.com/advisories/GHSA-p572-p2rj-q5f4) 2. [CVE-2024-35239](https://nvd.nist.gov/vuln/detail/CVE-2024-35239) 3. [Release notes for 13.0.1](https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024) 4. [Umbraco Forms configuration documentation](https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values) 0 Low Severity CVSS v3.1 Score 2.7 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None Advisory Timeline1. Discovered Sep 20, 2023 2. Disclosed Nov 6, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Jan 16, 2024 A commit was released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)