PT-2023-31145 · Umbraco · Umbraco
Bergmaniap
·
Publicado
2023-12-12
·
Atualizado
2023-12-15
·
CVE-2023-49278
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Umbraco versions 8.0.0 through 8.18.9
Umbraco versions 10.0.0 through 10.8.0
Umbraco versions 12.0.0 through 12.3.3
Description
Umbraco is an ASP.NET content management system (CMS) that is affected by a brute force exploit. This exploit can be used to collect valid usernames. The issue is related to the "forgot password" function when trying to log into the Backoffice. If the username or email is known, it is easier to find the corresponding password. The server's internal processing time takes longer if an email address that was already used and registered by a user is provided as an input.
Recommendations
For Umbraco versions 8.0.0 through 8.18.9, update to version 8.18.10 or later.
For Umbraco versions 10.0.0 through 10.8.0, update to version 10.8.1 or later.
For Umbraco versions 12.0.0 through 12.3.3, update to version 12.3.4 or later.
As a temporary workaround, consider restricting access to the "forgot password" function in the Backoffice to minimize the risk of exploitation.
Exploit
Correção
Improper Restriction of Excessive Authentication Attempts
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Umbraco