CVE-2023-49089
Last modified
CVE-2023-49089 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Cms | >= 8.0.0, < 8.18.10 |
| Umbraco | Umbraco Cms | >= 10.0.0, < 10.8.1 |
| Umbraco | Umbraco Cms | >= 12.0.0, < 12.3.0 |
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5Third Party Advisory
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-49089?
How severe is CVE-2023-49089?
How do I fix CVE-2023-49089?
Are you affected by CVE-2023-49089?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST