GitHub Advisoryadvisory · NuGet

GHSA-hmg4-wwm5-p999 Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

MEDIUM Published 2025-01-21 Modified 2025-04-17 Official page ↗
Aliases
CVE-2025-24011
Ecosystem
NuGet
Packages
Umbraco.Cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-203
Reviewed
2025-01-21

Affected packages

• NuGet Umbraco.Cms: >= 14.0.0, < 14.3.2 → fixed in 14.3.2 • NuGet Umbraco.Cms: >= 15.0.0, < 15.1.2 → fixed in 15.1.2

Description

Impact Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists. Patches Patched in 14.3.2 and 15.1.2. Workarounds None available.

Related

Alias · CVE (1)

  • CVE-2025-24011 Umbraco is a free and open source .NET content management system. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References