CVE-2024-43377: Umbraco CMS Improper Access Control vulnerability
Impact As an authenticated user one can access a few unintended endpoints
Explanation of the vulnerability Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was possible to get info from these endpoints using a member token.
Other sources
Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43377?
CVE-2024-43377 is considered a medium severity vulnerability due to the exposure of unintended endpoints.
How do I fix CVE-2024-43377?
To fix CVE-2024-43377, upgrade Umbraco CMS to version 14.1.2 or later.
What software is affected by CVE-2024-43377?
CVE-2024-43377 affects Umbraco CMS versions between 14.0.0 and 14.1.2.
Can CVE-2024-43377 be exploited by unauthenticated users?
No, CVE-2024-43377 requires the attacker to be an authenticated user to exploit the vulnerability.
What kind of access is granted through CVE-2024-43377?
CVE-2024-43377 allows authenticated users to access unintended endpoints within the Umbraco Management API.