GitHub Advisoryadvisory · NuGet

GHSA-j74q-mv2c-rxmp Umbraco CMS Open Redirect Bypass Protection

MEDIUM Published 2024-05-21 Modified 2025-02-12 Official page ↗
Aliases
CVE-2024-34071
Ecosystem
NuGet
Packages
UmbracoCms.Core, Umbraco.Cms.Web.BackOffice
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-05-21

Affected packages

• NuGet UmbracoCms.Core: >= 8.18.5, < 8.18.14 → fixed in 8.18.14 • NuGet UmbracoCms.Core: >= 10.5.0, < 10.8.6 → fixed in 10.8.6 • NuGet UmbracoCms.Core: >= 12.0.0, < 12.3.10 → fixed in 12.3.10 • NuGet UmbracoCms.Core: >= 13.0.0, < 13.3.1 → fixed in 13.3.1 • NuGet Umbraco.Cms.Web.BackOffice: >= 8.18.5, < 8.18.14 → fixed in 8.18.14 • NuGet Umbraco.Cms.Web.BackOffice: >= 10.5.0, < 10.8.6 → fixed in 10.8.6 • NuGet Umbraco.Cms.Web.BackOffice: >= 12.0.0, < 12.3.10 → fixed in 12.3.10 • NuGet Umbraco.Cms.Web.BackOffice: >= 13.0.0, < 13.3.1 → fixed in 13.3.1

Description

Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed. Affected Version \>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0 Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1

Related

Alias · CVE (1)

  • CVE-2024-34071 Umbraco is an ASP.NET CMS used by more than 730.000 websites. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References