CVE-2025-24011CWE-200

Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

Medium · published January 21, 2025

CVSS v3.1
5.3
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01520 · 74.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-01-21T15:27Z
EPSS history
Timeline
  • 21 JAN 15:27Z
    Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
    cvelistv5