CVE-2024-32872CWE-89

Umbraco Workflow's Backoffice users can execute arbitrary SQL

Medium · published April 24, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-04-24T14:46Z
EPSS history
Timeline
  • 24 APR 14:46Z
    Umbraco Workflow's Backoffice users can execute arbitrary SQL
    cvelistv5