GHSA-hmg4-wwm5-p999
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hmg4-wwm5-p999
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-hmg4-wwm5-p999/GHSA-hmg4-wwm5-p999.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hmg4-wwm5-p999
- Aliases
- Published
- 2025-01-21T21:21:30Z
- Modified
- 2025-01-21T21:42:05.388327Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes
- Details
-
Impact
Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.
Patches
Will be patched in 14.3.2 and 15.1.2.
Workarounds
None available.
- Database specific
{ "nvd_published_at": "2025-01-21T16:15:14Z", "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-21T21:21:30Z" }- References
-
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999
- https://nvd.nist.gov/vuln/detail/CVE-2025-24011
- https://github.com/umbraco/Umbraco-CMS/commit/559c6c9f312df1d6eb1bde82c4b81c0896da6382
- https://github.com/umbraco/Umbraco-CMS/commit/839b6816f2ae3e5f54459a0f09dad6b17e2d1e07
- https://github.com/umbraco/Umbraco-CMS
Affected packages
NuGet / Umbraco.Cms
Package
- Name
- Umbraco.Cms
- View open source insights on deps.dev
- Purl
- pkg:nuget/Umbraco.Cms
NuGet / Umbraco.Cms
Package
- Name
- Umbraco.Cms
- View open source insights on deps.dev
- Purl
- pkg:nuget/Umbraco.Cms