Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/56042?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/56042?format=api", "vulnerability_id": "VCID-e5g9-xgrk-eqaf", "summary": "Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice\nThere is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode.", "aliases": [ { "alias": "CVE-2024-48927" }, { "alias": "GHSA-5955-cwv4-h7qh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/106147?format=api", "purl": "pkg:nuget/Umbraco.Cms@10.8.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@10.8.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/106148?format=api", "purl": "pkg:nuget/Umbraco.Cms@13.5.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@13.5.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/83016?format=api", "purl": "pkg:nuget/UmbracoCms@8.18.15", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.18.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/83018?format=api", "purl": "pkg:nuget/Umbraco.CMS@10.8.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@10.8.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/83017?format=api", "purl": "pkg:nuget/Umbraco.CMS@13.5.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@13.5.2" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/68112?format=api", "purl": "pkg:nuget/UmbracoCms@8.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1rkh-7s4e-vyen" }, { "vulnerability": "VCID-2cmy-5q87-5bgb" }, { "vulnerability": "VCID-2e5t-qrxu-6bhc" }, { "vulnerability": "VCID-6hye-45tx-auc9" }, { "vulnerability": "VCID-azpt-qmk7-1ueu" }, { "vulnerability": "VCID-e5g9-xgrk-eqaf" }, { "vulnerability": "VCID-ehsc-c1uh-tua1" }, { "vulnerability": "VCID-s3pr-pezb-4qf4" }, { "vulnerability": "VCID-wtw6-zcw6-2yd2" }, { "vulnerability": "VCID-xu9a-vwjv-5ycb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/68173?format=api", "purl": "pkg:nuget/Umbraco.CMS@10.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2exh-k5tm-r3cy" }, { "vulnerability": "VCID-e5g9-xgrk-eqaf" }, { "vulnerability": "VCID-nhwe-aq8z-ryhn" }, { "vulnerability": "VCID-yhat-ry32-fqf5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@10.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/83020?format=api", "purl": "pkg:nuget/Umbraco.CMS@13.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-e5g9-xgrk-eqaf" }, { "vulnerability": "VCID-yhat-ry32-fqf5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@13.0.0" } ], "references": [ { "reference_url": "https://github.com/umbraco/Umbraco-CMS", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/umbraco/Umbraco-CMS" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48927", "reference_id": "CVE-2024-48927", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48927" }, { "reference_url": "https://github.com/advisories/GHSA-5955-cwv4-h7qh", "reference_id": "GHSA-5955-cwv4-h7qh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5955-cwv4-h7qh" }, { "reference_url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-5955-cwv4-h7qh", "reference_id": "GHSA-5955-cwv4-h7qh", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-5955-cwv4-h7qh" } ], "weaknesses": [ { "cwe_id": 74, "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "description": "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e5g9-xgrk-eqaf" }