GitHub Advisoryadvisory · NuGet

GHSA-4gp9-ff99-j6vj Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

LOW Published 2024-10-22 Modified 2024-10-22 Official page ↗
Aliases
CVE-2024-48925
Ecosystem
NuGet
Packages
Umbraco.CMS
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Weaknesses
CWE-284, CWE-863
Reviewed
2024-10-22

Affected packages

• NuGet Umbraco.CMS: >= 14.0.0, < 14.3.0 → fixed in 14.3.0

Description

Impact An improper access control issue has been identified, allowing low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section

Related

Alias · CVE (1)

  • CVE-2024-48925 Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References