PT-2023-25870 · Umbraco · Umbraco

1K-Off · Published 2023-07-13 · Updated 2023-07-25 · CVE-2023-37267

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 10.6.1 Umbraco versions prior to 11.4.2 Umbraco versions prior to 12.0.1

Description Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions, potentially leading to unauthorized access to the backoffice.

Recommendations For versions prior to 10.6.1, update to version 10.6.1 or later. For versions prior to 11.4.2, update to version 11.4.2 or later. For versions prior to 12.0.1, update to version 12.0.1 or later. As a temporary workaround, consider enabling the Unattended Install feature to prevent exploitation. Additionally, enabling IP restrictions to /install/* and /umbraco/* can limit exposure to allowed IP addresses.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-37267

GHSA-H8WC-R4JH-MG7M

Affected Products

Umbraco

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37267.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569 · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410e · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed · Patch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37267 · Security Note
• https://osv.dev/vulnerability/GHSA-h8wc-r4jh-mg7m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37267 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cibsecurity/66665 · Telegram Post
• https://t.me/cvenotify/54270 · Telegram Post