GitHub Advisoryadvisory · NuGet

GHSA-fp6q-gccw-7qqm Umbraco CMS logout page displayed before session expiration

MEDIUM Published 2024-10-22 Modified 2024-10-22 Official page ↗
Aliases
CVE-2024-48926
Ecosystem
NuGet
Packages
Umbraco.CMS, UmbracoCMS
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-613
Reviewed
2024-10-22

Affected packages

• NuGet Umbraco.CMS: >= 13.0.0, < 13.5.2 → fixed in 13.5.2 • NuGet Umbraco.CMS: >= 10.0.0, < 10.8.7 → fixed in 10.8.7 • NuGet UmbracoCMS: >= 8.0.0, < 8.18.15 → fixed in 8.18.15

Description

Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2024-48926 Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch… vulnerability

References