umbraco/umbraco-cms · Security
Umbraco possible user enumeration
- GHSA ID
- GHSA-552f-97wf-pmpq
- CVE ID
- CVE-2024-28868
- Severity
- low
- Published
- Updated
- CVSS
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Impact
A user enumeration attack is possible.
Affected versions
Umbraco 10 with access to the native login screen
Patches
This is fixed in 10.8.5
Workarounds
Disabling the native login screen, by exclusively use external logins.
CWEs
- CWE-203 · Observable Discrepancy
- CWE-204 · Observable Response Discrepancy