medium6.1
CVE-2024-34071
Umbraco CMS Open Redirect Bypass Protection
Impact
### Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed. ### Affected Version \>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0 ### Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | UmbracoCms.Core | >= 8.18.5, < 8.18.14 | 8.18.14 |
| nuget | Umbraco.Cms.Web.BackOffice | >= 8.18.5, < 8.18.14 | 8.18.14 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | from 8.18.5 before 8.18.14 from 10.5.0 before 10.8.6 from 12.0.0 before 12.3.10 from 13.0.0 before 13.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450
- https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f
- https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031
- https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp
- https://github.com/advisories/GHSA-j74q-mv2c-rxmp
- https://nvd.nist.gov/vuln/detail/CVE-2024-34071