CVE-2023-48227

Published: Dec 12, 2023Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.

Affected (3)

Products: Umbraco: Umbraco Cms

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Umbraco Umbraco Cms	From 11.0.0 to 12.3.0
Umbraco Umbraco Cms	From 8.0.0 to 8.18.10
Umbraco Umbraco Cms	From 9.0.0 to 10.7.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2

Source: security-advisories@github.com

URL Repurposed

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2

Source: af854a3a-2127-422b-91ae-364da2661108

URL Repurposed

Timeline

No history available yet.