~ / search / GHSA-j74q-mv2c-rxmp

GHSA-j74q-mv2c-rxmp

Umbraco CMS Open Redirect Bypass Protection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-34071

Packages

EcosystemPackageAffectedFixed in
NuGet UmbracoCms.Core >= 8.18.5, < 8.18.14 8.18.14
NuGet UmbracoCms.Core >= 10.5.0, < 10.8.6 10.8.6
NuGet UmbracoCms.Core >= 12.0.0, < 12.3.10 12.3.10
NuGet UmbracoCms.Core >= 13.0.0, < 13.3.1 13.3.1
NuGet Umbraco.Cms.Web.BackOffice >= 8.18.5, < 8.18.14 8.18.14
NuGet Umbraco.Cms.Web.BackOffice >= 10.5.0, < 10.8.6 10.8.6
NuGet Umbraco.Cms.Web.BackOffice >= 12.0.0, < 12.3.10 12.3.10
NuGet Umbraco.Cms.Web.BackOffice >= 13.0.0, < 13.3.1 13.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed. ### Affected Version \>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0 ### Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1

References

External links from the advisory. They lead to third-party sites.