Log in Start free

Vulnerability · Published Jun 24, 2025 · Assigned by GitHub_M

CVE-2025-49147Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

Medium 5.3

In plain English

A medium-severity security flaw in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 72.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password. This information was not exposed in Umbraco 7 or 8, nor in 14 or higher versions. The vulnerability is patched in versions 10.8.11 and 13.9.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGetumbraco.cms10.8.11GHSA-pgvc-6h2p-q4f6
NuGetumbraco.cms13.9.2GHSA-pgvc-6h2p-q4f6

Affected products (as reported)

VendorProductVersions
umbraco Umbraco-CMS >= 10.0.0, < 10.8.111>= 13.0.0, < 13.9.2

Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References