GitHub Advisoryadvisory · NuGet
GHSA-hrww-x3fq-xcvh Umbraco CMS Improper Access Control vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2024-43377
- Ecosystem
- NuGet
- Packages
- Umbraco.Cms
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2024-08-20
Affected packages
• NuGet Umbraco.Cms: >= 14.0.0, < 14.1.2 → fixed in 14.1.2
Description
Impact
As an authenticated user one can access a few unintended endpoints
Explanation of the vulnerability
Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was possible to get info from these endpoints using a member token.
Related
Alias · CVE (1)
- CVE-2024-43377 Umbraco CMS is an ASP.NET CMS. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness