Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-28868

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

Published

2024-03-20T20:15:09.110

Last Modified

2025-02-12T15:23:09.683

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

Weaknesses

Type: Secondary
CWE-204
Type: Primary
CWE-203

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	umbraco	umbraco_cms	< 10.8.5	Yes

References

https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d Patch ([email protected])
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq Vendor Advisory ([email protected])
https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)