CVEvulnerability

CVE-2025-24011

5.3 MEDIUM Published 2025-01-21 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-01-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-203

Description

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.

Affected configurations

• umbraco umbraco cms (>= 14.0.0 < 14.3.2) • umbraco umbraco cms (>= 15.0.0 < 15.1.2)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References