Security readout for executives and security teams
Plain-English summary
This CVE describes stored XSS in Umbraco CMS v14.3.1 through rich text content. The vendor disputes it because the scenario requires authenticated CMS users who were deliberately granted access, and product-level HTML sanitization was intentionally not applied. Treat this mainly as a content-trust and CMS-access governance issue, not confirmed unauthenticated compromise.
Executive priority
Prioritize review if the business allows agencies, customers, contractors, or many staff to edit Umbraco content. Lower urgency applies where CMS access is tightly controlled and editors are fully trusted.
Technical view
Reported issue is CWE-79 stored XSS in Umbraco CMS v14.3.1 via crafted rich-text HTML or script content. Public CVE data lists CVSS 6.5, but the note says exploitation depends on authenticated CMS access and is vendor-disputed. No source in the bundle identifies a vendor patch or broad affected-version range.
Likely exposure
Exposure is most plausible where Umbraco CMS v14.3.1 is used and less-trusted users can edit rich-text content rendered to site visitors or administrators.
Exploitation context
No KEV listing is present, and the provided sources do not report active exploitation. The scenario is disputed and appears limited to users already granted CMS access.
Researcher notes
The CVE record and description conflict with the vendor dispute note: CVSS suggests network exploitation without privileges, while the note says authenticated CMS access is required. Affected product metadata is also sparse, so avoid extrapolating beyond v14.3.1 from the supplied sources.
Mitigation direction
- Review current Umbraco guidance before assuming a product patch exists.
- Restrict CMS access to trusted users with least-privilege editing rights.
- Treat rich-text content from less-trusted editors as untrusted input.
- Use application-level sanitization where your design requires untrusted rich-text editing.
- Review templates that render rich-text content into public or privileged pages.
Validation and detection
- Inventory Umbraco deployments and identify any v14.3.1 instances.
- Confirm which users can create or edit rich-text CMS content.
- Review whether edited rich-text content is rendered to visitors or administrators.
- Check vendor, CVE, and NCC references for advisory changes.
- Document whether your threat model treats CMS editors as trusted.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-55488 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.