CVE-2024-43377
Umbraco CMS Improper Access Control vulnerability
5.4
MEDIUM
CVSS 3.1
EPSS 0.41%
Description
### Impact As an authenticated user one can access a few unintended endpoints ### Explanation of the vulnerability Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was possible to get info from these endpoints using a member token.
How to fix CVE-2024-43377
To remediate CVE-2024-43377, upgrade the affected package to a fixed version below.
- —upgrade to 14.1.2 or later
Is CVE-2024-43377 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 14.0.0, < 14.1.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |