Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

MITTEL 5.3CVE-2024-43376 · GHSA-77gj-crhp-3gvx · Published 20/08/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-43376 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in Umbraco.Cms.Api.Management, umbraco cms (umbraco).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.36%, höher als bei 30.2% aller Schwachstellen.
Abhilfe: auf 14.1.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
Umbraco.Cms.Api.Management NuGet	`≥ 14.0.0, < 14.1.2`	`14.1.2`
umbraco cms umbraco	`≥ 14.0.0, < 14.1.2`	`14.1.2`

Description

Impact

Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode.

Explanation of the vulnerability

Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled.

E.g. when paging with negative numbers in some apis

NVD description

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.

References

umbraco/Umbraco-CMS security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-43376 · ADVISORY
umbraco/Umbraco-CMS commit b76070c · WEB
umbraco/Umbraco-CMS · PACKAGE

Weitere Schwachstellen in Umbraco.Cms.Api.Management

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

Umbraco.Cms.Api.Management

NuGet

≥ 14.0.0, < 14.1.2

14.1.2

umbraco cms

umbraco

≥ 14.0.0, < 14.1.2

14.1.2

Description

Impact

Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode.

Explanation of the vulnerability

Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled.

E.g. when paging with negative numbers in some apis

NVD description

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.