CVE-2024-28868

2024-03-2020:15:09

CWE-204

GitHub_M

web.nvd.nist.gov

umbraco

asp.net

content management system

cve-2024-28868

vulnerability

user enumeration

nvd

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

Percentile

9.0%

JSON

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

Affected configurations

Vulners

Node

umbracoumbraco_cmsRange10.0.0–10.8.5

VendorProductVersionCPE
umbracoumbraco_cms*cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
umbraco	umbraco_cms	*	cpe:2.3:a:umbraco:umbraco_cms::::::::

CNA Affected

[
  {
    "vendor": "umbraco",
    "product": "Umbraco-CMS",
    "versions": [
      {
        "version": ">= 10.0.0, < 10.8.5",
        "status": "affected"
      }
    ]
  }
]