CVE-2023-37267 – umbraco.cms.infrastructure

Package

Manager: nuget
Name: umbraco.cms.infrastructure
Vulnerable Version: >=9.0.0 <10.6.1 || >=11.0.0 <11.4.2 || =12.0.0 || >=12.0.0 <12.0.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00313 pctl0.53867

Details

Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions. ### Impact An unauthorized user gaining admin-level access and permissions to the backoffice. ### Patches 10.6.1, 11.4.2, 12.0.1 ### Workarounds * Enabling the [Unattended Install](https://docs.umbraco.com/umbraco-cms/reference/configuration/unattendedsettings) feature will mean the vulnerability is not exploitable. * Enabling IP restrictions to `*/install/*` and `*/umbraco/*` will limit the exposure to allowed IP addresses.

Metadata

Created: 2023-07-13T17:02:07Z
Modified: 2023-07-13T17:02:07Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-h8wc-r4jh-mg7m/GHSA-h8wc-r4jh-mg7m.json
CWE IDs: ["CWE-284"]
Alternative ID: GHSA-h8wc-r4jh-mg7m
Finding: F039
Auto approve: 1