CVE-2024-28868

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

• CWE-204
• CWE-203

• https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44dPatch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpqVendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44dPatch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpqVendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28862The Ruby One Time Password library (ROTP) is an open source …5.5
• CVE-2024-28863node-tar is a Tar for Node.js. node-tar prior to version 6.2…6.5
• CVE-2024-28864SecureProps is a PHP library designed to simplify the encryp…2.6
• CVE-2024-28865django-wiki is a wiki system for Django. Installations of dj…7.5
• CVE-2024-28866GoCD is a continuous delivery server. GoCD versions from 19.…6.1
• CVE-2024-28867Swift Prometheus is a Swift client for the Prometheus monito…7.4
• CVE-2024-28869Traefik is an HTTP reverse proxy and load balancer. In affec…7.5
• CVE-2024-2887Type Confusion in WebAssembly in Google Chrome prior to 123.…7.7
• CVE-2024-28870Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-28871LibHTP is a security-aware parser for the HTTP protocol and …7.5
• CVE-2024-28872The TLS certificate validation code is flawed. An attacker c…8.1
• CVE-2024-28875A security flaw involving hard-coded credentials in LevelOne…8.1