PT-2024-30538 · Umbraco · Umbraco

Bergmania · Published 2024-08-20 · Updated 2024-08-26 · CVE-2024-43376

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 14.1.2

Description The issue concerns Umbraco, an ASP.NET CMS, where some endpoints in the Management API can return stack trace information even when Umbraco is not in debug mode. This can occur, for example, when paging with negative numbers in some APIs, leading to the leakage of stack traces in case of internal server errors, regardless of the debug setting being disabled.

Recommendations For versions prior to 14.1.2, update to version 14.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the Management API endpoints that are leaking stack trace information until the update can be applied.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2024-43376

GHSA-77GJ-CRHP-3GVX

Affected Products

Umbraco

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43376.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-77gj-crhp-3gvx · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43376 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77gj-crhp-3gvx · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/CVEnew/status/1825908447516238075 · Twitter Post
• https://t.me/cvenotify/92206 · Telegram Post
• https://t.me/cvedetector/3651 · Telegram Post