CVE-2024-35240: 
C# vulnerability analysis and mitigation

Umbraco Commerce, an open source dotnet ecommerce solution, was found to contain a stored Cross-site Scripting (XSS) vulnerability (CVE-2024-35240). The vulnerability enables attackers to inject malicious code into the Print Functionality. This security issue was discovered and disclosed in May 2024, affecting versions prior to 12.1.4 and 10.0.5 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with low impact on both confidentiality and integrity, and no impact on availability (GitHub Advisory).

The vulnerability allows attackers to perform stored cross-site scripting attacks through the Print Functionality, potentially leading to the execution of malicious code in the context of other users' sessions. This could result in unauthorized access to user data and potential manipulation of the application's behavior (GitHub Advisory).

The vulnerability can be exploited remotely and requires no special privileges, though user interaction is necessary for successful exploitation. The attack vector is network-based, with low complexity requirements for exploitation (GitHub Advisory).

The vulnerability has been patched in Umbraco Commerce versions 12.1.4 and 10.0.5. Users are advised to upgrade to these or newer versions as there are no known workarounds for this vulnerability (Umbraco Docs).