CVE-2023-49089CWE-22

Umbraco CMS possible path traversal when creating packages from backoffice

High · published December 12, 2023

CVSS v3.1
7.7
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-12-12T19:02Z
EPSS history
Timeline
  • 12 DEC 19:02Z
    Umbraco CMS possible path traversal when creating packages from backoffice
    cvelistv5