Vulnerabilities > CVE-2024-28868 - Information Exposure Through Discrepancy vulnerability in Umbraco CMS

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

umbraco

CWE-203

NVD

Published: 2024-03-20

Updated: 2025-02-12

Summary

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

Vulnerable Configurations

Part	Description	Count
Application	Umbraco Umbraco Umbraco CMS 10.0.0 Umbraco Umbraco CMS 10.0.1 Umbraco Umbraco CMS 10.1.0 Umbraco Umbraco CMS 10.1.1 Umbraco Umbraco CMS 10.2.0 Umbraco Umbraco CMS 10.2.1 Umbraco Umbraco CMS 10.3.0 Umbraco Umbraco CMS 10.3.1 Umbraco Umbraco CMS 10.3.2 Umbraco Umbraco CMS 10.4.0 Umbraco Umbraco CMS 10.4.1 Umbraco Umbraco CMS 10.4.2 Umbraco Umbraco CMS 10.5.0 Umbraco Umbraco CMS 10.5.1 Umbraco Umbraco CMS 10.6.0 Umbraco Umbraco CMS 10.6.1 Umbraco Umbraco CMS 10.7.0 Umbraco Umbraco CMS 10.8.0 Umbraco Umbraco CMS 10.8.1 Umbraco Umbraco CMS 10.8.2 Umbraco Umbraco CMS 10.8.3 Umbraco Umbraco CMS 10.8.4	35

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References