GitHub Advisoryadvisory · NuGet

GHSA-77gj-crhp-3gvx Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

MEDIUM Published 2024-08-20 Modified 2024-09-17 Official page ↗
Aliases
CVE-2024-43376
Ecosystem
NuGet
Packages
Umbraco.Cms.Api.Management
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2024-08-20

Affected packages

• NuGet Umbraco.Cms.Api.Management: >= 14.0.0, < 14.1.2 → fixed in 14.1.2

Description

Impact Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. Explanation of the vulnerability Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled. E.g. when paging with negative numbers in some apis

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References