PT-2020-17166 · Umbraco · Umbraco

Published 2020-12-02 · Updated 2021-07-21 · CVE-2020-29454

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions through 8.9.1

Description The issue allows a user to access a log viewer endpoint without having the necessary Applications.Settings access. This is due to a problem in the Editors/LogViewerController.cs file.

Recommendations For Umbraco versions through 8.9.1, consider restricting access to the log viewer endpoint until a fix is available. As a temporary workaround, review and adjust the access controls for the Applications.Settings to ensure that only authorized users can access the log viewer.

Fix

Incorrect Authorization

Incorrect Permission

Weakness Enumeration

CWE-863

CWE-732

Related Identifiers

CVE-2020-29454

GHSA-4VP3-VFWW-8648

Affected Products

Umbraco

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-29454 · Security Note
• https://osv.dev/vulnerability/GHSA-4vp3-vfww-8648 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29454 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/pull/9361 · Note
• https://t.me/cvenotify/6444 · Telegram Post