Umbraco Cross-Site Scripting Vulnerability in Localized Backoffice Components

A cross-site scripting vulnerability has been identified in Umbraco, a .NET content management system, affecting versions 14.0.0 prior to 14.3.2 and 15.1.2. This vulnerability allows authenticated users to inject malicious scripts when viewing certain localized backoffice components. The issue arises because user input is not properly sanitized before being displayed, particularly in the dictionary workspace.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can navigate to specific localized backoffice components within the Umbraco dictionary workspace. The injected script, such as a JavaScript alert, will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Umbraco versions 14.3.2 or 15.1.2, both of which include the necessary patch to address this vulnerability.