PT-2024-33273 · Umbraco · Umbraco

Thanhlam-Attt · Published 2024-10-22 · Updated 2024-10-25 · CVE-2024-48925

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 14.0.0 through 14.2.x

Description The issue is related to improper access control, allowing low-privilege users to access the webhook API and retrieve restricted information. This affects the settings section, where access should be limited to users with appropriate permissions.

Recommendations For Umbraco versions 14.0.0 through 14.2.x, update to version 14.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the webhook API until the patch is applied.

Exploit

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

CVE-2024-48925

GHSA-4GP9-FF99-J6VJ

Affected Products

Umbraco

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48925.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4gp9-ff99-j6vj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4gp9-ff99-j6vj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48925 · Security Note
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/CVEnew/status/1848797754388013500 · Twitter Post
• https://t.me/cvedetector/8624 · Telegram Post