CVE-2024-28868CWE-204

Umbraco possible user enumeration vulnerability

Low · published March 20, 2024

CVSS v3.1
3.7
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2024-03-20T20:07Z
EPSS history
Timeline
  • 20 MAR 20:07Z
    Umbraco possible user enumeration vulnerability
    cvelistv5