GitHub Advisoryadvisory · NuGet

GHSA-552f-97wf-pmpq Umbraco possible user enumeration

LOW Published 2024-03-20 Modified 2025-02-12 Official page ↗

Aliases: CVE-2024-28868
Ecosystem: NuGet
Packages: UmbracoCMS
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-203, CWE-204
Reviewed: 2024-03-20

Affected packages

• NuGet UmbracoCMS: >= 10.0.0, < 10.8.5 → fixed in 10.8.5

Description

Impact A user enumeration attack is possible. Affected versions Umbraco 10 with access to the native login screen Patches This is fixed in 10.8.5 Workarounds Disabling the native login screen, by exclusively use external logins.

Alias · CVE (1)

CVE-2024-28868 Umbraco is an ASP.NET content management system. vulnerability

Weakness · CWE (2)

CWE-203 Observable Discrepancy weakness
CWE-204 Observable Response Discrepancy weakness

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq web
https://nvd.nist.gov/vuln/detail/CVE-2024-28868 advisory
https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d web
https://github.com/umbraco/Umbraco-CMS package