CVE-2024-48925 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to th...

CVE-2024-48925 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to th...

CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...

CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...

Tropic Trooper spies on government entities in the Middle East

Executive summary Tropic Trooper also known as KeyBoy and Pirate Panda is an APT group active since 2011. This group has traditionally targeted sectors such as government, healthcare, transportation and high-tech industries in Taiwan, the Philippines and Hong Kong. Our recent investigation has...

Unauthorized Access

Umbraco CMS is vulnerable to unauthorized access. The vulnerability is due to insufficient access control mechanisms that fail to properly restrict access to certain endpoints based on user permissions, which allows to gain unauthorized information or performing actions outside their intended...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to missing authorization requirements. An authenticated attacker can access unintended endpoints by exploiting the vulnerability. Remediation Upgrade Umbraco.Cms.Api.Management to version 14.1.2 or higher...

GHSA-HRWW-X3FQ-XCVH Umbraco CMS Improper Access Control vulnerability

Impact As an authenticated user one can access a few unintended endpoints Explanation of the vulnerability Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was...

Umbraco CMS Improper Access Control vulnerability

Impact As an authenticated user one can access a few unintended endpoints Explanation of the vulnerability Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was...

Generation of Error Message Containing Sensitive Information

Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Generation of Error Message Containing Sensitive Information. An attacker can obtain stack trace information that may include sensitive data by...

GHSA-77GJ-CRHP-3GVX Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

Impact Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. Explanation of the vulnerability Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled. E.g. when paging wi...

Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

Impact Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. Explanation of the vulnerability Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled. E.g. when paging wi...

CVE-2024-43377

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2...

CVE-2024-43377 Umbraco CMS Improper Access Control vulnerability

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2...

CVE-2024-43377 Umbraco CMS Improper Access Control vulnerability

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2...

CVE-2024-43377 Umbraco CMS Improper Access Control vulnerability

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2...

CVE-2024-43377

CVE-2024-43377 affects Umbraco CMS (ASP.NET). An authenticated user could access a small set of unintended endpoints due to insufficient access restrictions in the Umbraco Management API. The issue is mitigated by upgrading to version 14.1.2 or newer, which fixes the vulnerability. The public adv...

Open Redirect

umbraco.cms is vulnerable to Open Redirect. The vulnerability is due to improper validation of redirect targets, which results in authenticated users being redirected to malicious websites after logging into the backoffice...

Cross-site Scripting (XSS)

Overview UmbracoCms.Web is an ASP.NET CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown Editor Preview Pane. An attacker can inject malicious content into a website or application by exploiting this vulnerability. Details Cross-site scripting or XSS...

Cross-site Scripting (XSS)

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown Editor Preview Pane. An attacker can inject malicious content into a website or application by exploiting this vulnerability. Details Cross-site scripting or XS...