CVE-2023-37267
- Source
- https://cve.org/CVERecord?id=CVE-2023-37267
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37267.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-37267
- Aliases
- Published
- 2023-07-13T13:43:59.383Z
- Modified
- 2026-08-12T03:51:42.622652281Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
- Details
-
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37267.json", "cwe_ids": [ "CWE-284" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37267.json
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7m
- https://nvd.nist.gov/vuln/detail/CVE-2023-37267
- https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410e
- https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569
- https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed
Affected packages
Git / github.com/umbraco/umbraco-cms
Affected ranges
- Type
- GIT
- Repo
- https://github.com/umbraco/umbraco-cms
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "10.0.0" }, { "fixed": "10.6.1" }, { "introduced": "11.0.0" }, { "fixed": "11.4.2" }, { "introduced": "12.0.0" }, { "fixed": "12.0.1" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }