CVE-2023-49278 Umbraco CMS brute force exploit can be used to collect valid usernames

2023-12-1219:14:02

CWE-200

CWE-307

GitHub_M

www.cve.org

umbraco cms

brute force

exploit

usernames

asp.net

security vulnerability

patch

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0005 Low

EPSS

Percentile

17.0%

JSON

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

CNA Affected

[
  {
    "vendor": "umbraco",
    "product": "Umbraco-CMS",
    "versions": [
      {
        "version": ">= 8.0.0, < 8.18.10",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0-rc001, < 10.8.1",
        "status": "affected"
      },
      {
        "version": ">= 11.0.0-rc1, < 12.3.4",
        "status": "affected"
      }
    ]
  }
]