PT-2024-30539 · Umbraco · Umbraco Cms

Bergmania · Published 2024-08-20 · Updated 2024-08-26 · CVE-2024-43377

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 14.1.2

Description The issue allows an authenticated user to access a few unintended endpoints. This is because a few endpoints in the Umbraco Management API were not properly protected, requiring only authentication. As a result, it was possible to retrieve information from these endpoints using a member token.

Recommendations For versions prior to 14.1.2, update to version 14.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the unintended endpoints in the Umbraco Management API until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-43377

GHSA-HRWW-X3FQ-XCVH

Affected Products

Umbraco Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43377.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf · Patch
• https://osv.dev/vulnerability/CVE-2024-43377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43377 · Security Note
• https://osv.dev/vulnerability/GHSA-hrww-x3fq-xcvh · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cvenotify/92207 · Telegram Post
• https://twitter.com/CVEnew/status/1825908446132146332 · Twitter Post
• https://t.me/cvedetector/3648 · Telegram Post