PT-2024-25682 · Umbraco · Umbraco

0Xryuzak1 · Published 2024-05-21 · Updated 2025-02-12 · CVE-2024-34071

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 8.18.5 through 8.18.13 Umbraco versions 10.5.0 through 10.8.5 Umbraco versions 12.0.0 through 12.3.9 Umbraco versions 13.0.0 through 13.3.0

Description Umbraco is an ASP.NET CMS used by more than 730,000 websites. It has an endpoint that is vulnerable to open redirects. The endpoint is protected, requiring the user to be signed into the backoffice before the vulnerability is exposed.

Recommendations For Umbraco versions 8.18.5 through 8.18.13, update to version 8.18.14 to resolve the issue. For Umbraco versions 10.5.0 through 10.8.5, update to version 10.8.6 to resolve the issue. For Umbraco versions 12.0.0 through 12.3.9, update to version 12.3.10 to resolve the issue. For Umbraco versions 13.0.0 through 13.3.0, update to version 13.3.1 to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-34071

GHSA-J74Q-MV2C-RXMP

Affected Products

Umbraco

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34071.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031 · Patch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450 · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-34071 · Security Note
• https://osv.dev/vulnerability/GHSA-j74q-mv2c-rxmp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34071 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cvenotify/80564 · Telegram Post
• https://twitter.com/CVEnew/status/1792913363023843449 · Twitter Post
• https://t.me/cvenotify/80580 · Telegram Post
• https://t.me/cvenotify/111067 · Telegram Post
• https://twitter.com/linuxpatch/status/1792935088084144359 · Twitter Post