En bref
- CVE-2023-37267 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant Umbraco.Cms.Infrastructure, Umbraco.Cms.Web.BackOffice, umbraco cms (umbraco).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.71%, plus élevée que 53.7% des vulnérabilités.
- Correctif : mettre à jour vers 11.4.2, 12.0.1, 10.6.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.Cms.Infrastructure NuGet | ≥ 11.0.0, < 11.4.2≥ 12.0.0, < 12.0.1≥ 9.0.0, < 10.6.1
| 11.4.212.0.110.6.1
|
| Umbraco.Cms.Web.BackOffice NuGet | ≥ 11.0.0, < 11.4.2≥ 12.0.0, < 12.0.1≥ 9.0.0, < 10.6.1
| 11.4.212.0.110.6.1
|
| umbraco cms | ≥ 10.0.0, < 10.6.1≥ 11.0.0, < 11.4.2≥ 12.0.0, < 12.0.1
| 10.6.111.4.212.0.1
|
Description
Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions.
Impact
An unauthorized user gaining admin-level access and permissions to the backoffice.
Patches
10.6.1, 11.4.2, 12.0.1
Workarounds
- Enabling the Unattended Install feature will mean the vulnerability is not exploitable.
- Enabling IP restrictions to
*/install/* and */umbraco/* will limit the exposure to allowed IP addresses.
NVD description
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
Autres vulnérabilités de Umbraco.Cms.Infrastructure
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free