CVE-2023-49279

Summary

CVE-2023-49279 is a vulnerability affecting Umbraco, an ASP.NET content management system. Users with backoffice access can upload SVG files containing scripts, which can be executed if another user loads the media directly in their browser. This issue impacts versions 7.0.0 and prior to 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0. Patches are available for these versions, and workarounds include implementing server-side file validation or serving all media from a different host.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.