medium4.3
CVE-2024-43376
Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
Impact
### Impact Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. ### Explanation of the vulnerability Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled. E.g. when paging with negative numbers in some apis
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.Api.Management | >= 14.0.0, < 14.1.2 | 14.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | from 14.0.0 before 14.1.2 |