Vulnerability · Published Dec 12, 2023 · Assigned by GitHub_M
CVE-2023-49274Umbraco CMS SMTP misconfiguration exposes potential registered user email
Low 3.7
In plain English
A low-severity information exposure in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | umbraco.cms | 8.18.10 | GHSA-8qp8-9rpw-j46c |
| NuGet | umbraco.cms | 10.8.1 | GHSA-8qp8-9rpw-j46c |
| NuGet | umbraco.cms | 12.3.4 | GHSA-8qp8-9rpw-j46c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| umbraco | Umbraco-CMS | >= 8.0.0, < 8.18.10>= 9.0.0-rc001, < 10.8.1>= 11.0.0-rc1, < 12.3.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-8qp8-9rpw-j46c x_refsource_CONFIRM