--- title: "CVE-2024-35240" date: "2024-09-23T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-35240/" --- # CVE-2024-35240 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Dec 13, 2023 CVE-2024-35240 **Published:** Sep 23, 2024 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 5.4 Medium Severity Stored-XSS umbraco-commerce XSS RS Raphael Silva Reported by Checkmarx Zero Details Overview ## Summary The package `Umbraco.Commerce` contains a stored XSS vulnerability in the Print functionality of the order management system. The vulnerability is triggered when an admin attempts to print an order that contains malicious JavaScript injected by a user in the Billing or Shipping information fields during a purchase. This issue affects multiple fields and allows the execution of arbitrary JavaScript in the context of the admin’s session. The vulnerability was fixed by sanitizing the user inputs before rendering them in the print page. ## Product This vulnerability affects the `Umbraco.Commerce` package prior to versions 12.1.4 and 10.0.5. ## Impact This vulnerability allows an attacker to inject arbitrary JavaScript in order details, which gets executed when an admin prints the order. The potential impacts include privilege escalation or unauthorized actions carried out with admin privileges (such as remote code execution). ## Steps to reproduce 1. Place an order on the front end of the `Umbraco Commerce` application. 2. Inject malicious JavaScript into the Billing/Shipping information fields. 3. Log in to the backoffice as an administrator. 4. Navigate to the order in question and click on “Print Order” under the following path: `/umbraco/#/commerce/commerce/order-edit/` 5. The injected script will execute upon printing the order. ### Expected result: The XSS is triggered, and the malicious JavaScript is executed in the context of the admin’s session. ## Remediation The issue was fixed by sanitizing user inputs in the Billing/Shipping fields before rendering them in the print page. A fix was released on Dec 13, 2023. Users are advised to update to Umbraco versions 10.0.5 or 12.1.4, which include this fix. ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Raphael Silva](https://www.linkedin.com/in/raphaelcssilva/). ## Resources 1. [Release Notes](https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023) 2. [GHSA-rpj9-xjwm-wr6w](https://github.com/advisories/GHSA-rpj9-xjwm-wr6w) 3. [CVE-2024-35240](https://nvd.nist.gov/vuln/detail/CVE-2024-35240) 0 Medium Severity CVSS v3.1 Score 5.4 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Sep 20, 2023 2. Disclosed Nov 6, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Dec 13, 2023 A commit was released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)