XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Date: 2025-01
Affected: npm/@umbraco-cms/backoffice, npm/@umbraco-cms/backoffice, nuget/Umbraco.Cms.StaticAssets
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-24012
CWE: CWE-79
CVSS: 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

### Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. ### Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil


Mitigations:

Architectural layers (MAESTRO):