CVE-2023-49274: Umbraco CMS SMTP misconfiguration exposes potential registered user email
Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled
Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.
Other sources
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49274?
CVE-2023-49274 is considered to have a moderate severity due to the potential for user enumeration attacks.
How do I fix CVE-2023-49274?
To fix CVE-2023-49274, ensure that your SMTP settings are correctly configured and implement measures to standardize error messages.
Which versions of Umbraco CMS are affected by CVE-2023-49274?
CVE-2023-49274 affects Umbraco CMS versions from 8.0.0 up to 8.18.10, from 9.0.0 up to 10.8.1, and from 12.0.0 up to 12.3.4.
What type of attack is CVE-2023-49274 associated with?
CVE-2023-49274 is associated with a user enumeration attack facilitated by the reset password functionality.
What should I do if I cannot update to the fixed versions for CVE-2023-49274?
If you cannot update, implement custom error handling to obscure user existence and prevent enumeration.