PT-2023-25870 · Umbraco · Umbraco

1K-Off · Publicado 2023-07-13 · Atualizado 2023-07-25 · CVE-2023-37267

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 10.6.1 Umbraco versions prior to 11.4.2 Umbraco versions prior to 12.0.1

Description Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions, potentially leading to unauthorized access to the backoffice.

Recommendations For versions prior to 10.6.1, update to version 10.6.1 or later. For versions prior to 11.4.2, update to version 11.4.2 or later. For versions prior to 12.0.1, update to version 12.0.1 or later. As a temporary workaround, consider enabling the Unattended Install feature to prevent exploitation. Additionally, enabling IP restrictions to /install/* and /umbraco/* can limit exposure to allowed IP addresses.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-37267

GHSA-H8WC-R4JH-MG7M

Produtos afetados

Umbraco

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37267.json · Exploit
• https://github.com/umbraco/Umbraco-CMS · Nota
• https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569 · Correção
• https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410e · Correção
• https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed · Correção
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37267 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h8wc-r4jh-mg7m · Aviso do Fabricante
• https://t.me/cibsecurity/66665 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37267 · Aviso do Fabricante
• https://t.me/cvenotify/54270 · Publicação no Telegram