CVE-2023-48227CWE-863

Umbraco CMS Backoffice User can bypass "Publish" restriction

Medium · published December 12, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 34.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-12-12T17:12Z
EPSS history
Timeline
  • 12 DEC 17:12Z
    Umbraco CMS Backoffice User can bypass "Publish" restriction
    cvelistv5