Brute force exploit can be used to collect valid usernames

TRUNG BÌNH 5.3CVE-2023-49278 · GHSA-7x74-h8cw-qhxq · Công bố 12/12/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-49278 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng Umbraco.CMS, umbraco cms (umbraco).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.50%, cao hơn 42.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 12.3.4, 8.18.10, 10.8.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
Umbraco.CMS NuGet	`≥ 11.0.0, < 12.3.4≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.8.1`	`12.3.48.18.1010.8.1`
umbraco cms umbraco	`≥ 10.0.0, < 10.8.1≥ 12.0.0, < 12.3.4≥ 8.0.0, < 8.18.10`	`10.8.112.3.48.18.10`

Mô tả

Impact

A brute force exploit that can be used to collect valid usernames is possible.

Explanation of the vulnerability

It's a brute force exploit that can be used to collect valid usernames by using the “forgot password” function when trying to log into the Backoffice. If the username/email is known, it is easier to find the corresponding password. If an email address that was already used and registered by a user, is provided as an input, the server internal processing time takes longer. If the email address does not exist in the database of the registered users, the server would respond immediately.

Mô tả của NVD

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.