CVE-2023-49274

2023-12-1220:15:07

Google

osv.dev

umbraco

cms

user enumeration

smtp

misconfiguration

security vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

CPENameOperatorVersion
umbraco-cmseqrelease-7.15.4
umbraco-cmseqrelease-8.1.2
umbraco-cmseqrelease-8.10.3
umbraco-cmseqrelease-8.18.4
umbraco-cmseqrelease-8.7.2
umbraco-cmseqrelease-8.18.2
umbraco-cmseqrelease-8.6.1
umbraco-cmseqrelease-8.8
umbraco-cmseqrelease-8.6.4
umbraco-cmseqrelease-8.16.0

Name	Operator	Version
umbraco-cms	eq	release-7.15.4
umbraco-cms	eq	release-8.1.2
umbraco-cms	eq	release-8.10.3
umbraco-cms	eq	release-8.18.4
umbraco-cms	eq	release-8.7.2
umbraco-cms	eq	release-8.18.2
umbraco-cms	eq	release-8.6.1
umbraco-cms	eq	release-8.8
umbraco-cms	eq	release-8.6.4
umbraco-cms	eq	release-8.16.0