GitHub Advisoryadvisory · NuGet

GHSA-4vp3-vfww-8648 Incorrect permission enforcement in UmbracoCms

MEDIUM Published 2021-04-13 Modified 2021-04-09 Official page ↗

Aliases: CVE-2020-29454
Ecosystem: NuGet
Packages: UmbracoCms
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-732
Reviewed: 2021-04-09

Affected packages

• NuGet UmbracoCms: < 8.10.0 → fixed in 8.10.0

Description

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

Related

Alias · CVE (1)

CVE-2020-29454 Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings… vulnerability

Weakness · CWE (1)

CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References