Vulnerability · Published Jan 21, 2025 · Assigned by GitHub_M
CVE-2025-24011Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Medium 5.3
In plain English
A medium-severity information exposure in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | umbraco.cms | 14.3.2 | GHSA-hmg4-wwm5-p999 |
| NuGet | umbraco.cms | 15.1.2 | GHSA-hmg4-wwm5-p999 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| umbraco | Umbraco-CMS | >= 14.0.0, < 14.3.2>= 15.0.0, < 15.1.2 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999 x_refsource_CONFIRM
- https://github.com/umbraco/Umbraco-CMS/commit/559c6c9f312df1d6eb1bde82c4b81c0896da6382 x_refsource_MISC
- https://github.com/umbraco/Umbraco-CMS/commit/839b6816f2ae3e5f54459a0f09dad6b17e2d1e07 x_refsource_MISC