CVE-2025-24011

Katalog CVE

CVSS 5.3 · Medium EPSS 1,5%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada umbraco cms. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.

Rincian

Terbit di NVD

21 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-203: Observable Discrepancy

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999 advisory vendor
• https://github.com/umbraco/Umbraco-CMS/commit/559c6c9f312df1d6eb1bde82c4b81c0896da6382 patch
• https://github.com/umbraco/Umbraco-CMS/commit/839b6816f2ae3e5f54459a0f09dad6b17e2d1e07 patch