CVE-2024-48925

low-risk

Published 2024-10-22

Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section. Version 14.3.0 contains a patch.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

Affected Products (1)

Umbraco Cms

Affected Vendors

Umbraco

References (1)

Vendor Advisory https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4gp9-ff99-j6vj

/ 100

low-risk

Severity 7/34 · Low

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal