Skip to content
OpenAdvisories
High · 7.5 CVE-2023-37267 EUVD-2023-2073GHSA-h8wc-r4jh-mg7m

Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Published Jul 13, 2023 · Updated Oct 31, 2024 · Assigned by GitHub_M

Vendor: umbraco Product: Umbraco-CMS Package: Umbraco.Cms.Infrastructure Package: Umbraco.Cms.Web.BackOffice Ecosystem: NuGet

Description

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

Affected products

VendorProductAffectedFixed
umbraco Umbraco-CMS >= 9.0.0, < 10.6.1, >= 11.0.0, < 11.4.2, = 12.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Umbraco.Cms.Infrastructure >= 9.0.0, < 10.6.1 10.6.1 GHSA-h8wc-r4jh-mg7m
NuGet Umbraco.Cms.Infrastructure >= 11.0.0, < 11.4.2 11.4.2 GHSA-h8wc-r4jh-mg7m
NuGet Umbraco.Cms.Infrastructure >= 12.0.0, < 12.0.1 12.0.1 GHSA-h8wc-r4jh-mg7m
NuGet Umbraco.Cms.Web.BackOffice >= 9.0.0, < 10.6.1 10.6.1 GHSA-h8wc-r4jh-mg7m
NuGet Umbraco.Cms.Web.BackOffice >= 11.0.0, < 11.4.2 11.4.2 GHSA-h8wc-r4jh-mg7m
NuGet Umbraco.Cms.Web.BackOffice >= 12.0.0, < 12.0.1 12.0.1 GHSA-h8wc-r4jh-mg7m

References