Information Exposure

Umbraco is vulnerable to Information Exposure/User Enumeration. The vulnerability is due to PostRequestPasswordReset function in AuthenticationController.cs not have a feature to randomize the response time when processing password reset requests. This allows an attacker to potentially use the...

HTML Injection

Umbraco is vulnerable to HTML Injection. The vulnerability is due to improper user sanitization and validation. This issue can be exploited by an attacker to inject malicious html tags...

Cross-Site Scripting (XSS)

umbraco.cms is vulnerable to Cross-Site Scripting. The vulnerability is due to login.controller.js because there is no validation if the returnPath URI is from same origin. This allows attacker to perform URL redirection or DOM based XSS into the web application...

Stored Cross Site Scripting

Umbraco is vulnerable to Stored Cross Site Scripting. The vulnerability is due to improper validation on SVG file uploads. This issue can be exploited by an attacker via uploading malicious SVG file containing JavaScript...

Path Traversal

Umbraco is vulnerable to Path Traversal. The vulnerability is due to backoffice users with permissions to create packages, enabling them to exploit path traversal and write files outside of the expected location. This issue can be exploited by an attacker to write malicious files on the server...

Incorrect Authorization

Overview UmbracoCms.Web is an ASP.NET CMS. Affected versions of this package are vulnerable to Incorrect Authorization due to improper access control mechanisms. An attacker can gain access to unauthorized functionalities or data by exploiting the endpoints that are not adequately secured...

Exposure of Sensitive Information

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information via a brute force attack. An attacker can collect valid usernames by repeatedly attempting to authenticate with different usernames. Remediation Upgrade Umbraco.Cms to version 10.8.1, 12.3.4 or higher...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. An attacker with access to the backoffice can upload malicious SVG files containing scripts, which may be executed if another user is tricked into loadi...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' due to insufficient validation of user-supplied input in the package creation functionality. An attacker with permission to...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to improper configuration of the SMTP settings combined with enabled password reset functionality. An attacker can enumerate user accounts by observing the behavior of the password reset feature. Remediation...

CVE-2023-49278

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue...

CVE-2023-49279

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...

CVE-2023-49274

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

Information disclosure

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue...

Input validation

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...

Default credentials

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

CVE-2023-49279 Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...

CVE-2023-49279

CVE-2023-49279 – Umbraco SVG backoffice upload issue : Umbraco CMS (ASP.NET) versions prior to patches allow a backoffice user to upload SVG files containing scripts. If another user loads the media in a browser, scripts can execute. Affected versions: 7.0.0 through just-before patches 7.15.11, 8...

CVE-2023-49279 Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...

CVE-2023-49279 Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco is an ASP.NET content management system CMS. Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a...