CVE-2024-34071
Open Redirect Bypass Protection
Severity Score
6.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.
Umbraco es un CMS ASP.NET utilizado por más de 730.000 sitios web. Umbraco tiene un endpoint que es vulnerable a redireccionamientos abiertos. El endpoint está protegido, por lo que requiere que el usuario inicie sesión en el backoffice antes de que la vulnerabilidad quede expuesta. Esta vulnerabilidad ha sido parcheada en las versiones 8.18.14, 10.8.6, 12.3.10 y 13.3.1.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-30 CVE Reserved
- 2024-05-21 CVE Published
- 2024-05-22 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024 | X_refsource_misc | |
| https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 8.18.5 < 8.18.14 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 8.18.5 < 8.18.14" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 10.5.0 < 10.8.6 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 10.5.0 < 10.8.6" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 12.0.0 < 12.3.10 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 12.0.0 < 12.3.10" | en |
Affected
| ||||||
| Umbraco Search vendor "Umbraco" | Umbraco-CMS Search vendor "Umbraco" for product "Umbraco-CMS" | >= 13.0.0 < 13.3.1 Search vendor "Umbraco" for product "Umbraco-CMS" and version " >= 13.0.0 < 13.3.1" | en |
Affected
| ||||||