CVE-2024-43376: Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
First published: Tue Aug 20 2024(Updated: )
### Impact Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. ### Explanation of the vulnerability Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled. E.g. when paging with negative numbers in some apis
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| nuget/Umbraco.Cms.Api.Management | >=14.0.0<14.1.2 | 14.1.2 |
| Umbraco CMS | >=14.0.0<14.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-43376?
CVE-2024-43376 is considered a high-severity vulnerability due to the exposure of stack trace information.
How do I fix CVE-2024-43376?
To fix CVE-2024-43376, update to Umbraco CMS version 14.1.2 or later.
What are the potential impacts of CVE-2024-43376?
The potential impacts of CVE-2024-43376 include disclosing sensitive internal stack trace information to unauthorized users.
Which versions of Umbraco CMS are affected by CVE-2024-43376?
CVE-2024-43376 affects Umbraco CMS versions between 14.0.0 and 14.1.2.
Are there any workarounds for CVE-2024-43376?
There are no known workarounds for CVE-2024-43376; updating to the patched version is recommended.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-77gj-crhp-3gvx
- alias/CVE-2024-43376
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/description
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/nuget
- vendor/umbraco
- canonical/umbraco cms
- version/umbraco cms/14.0.0