Skip to main content

Umbraco Cms CVE-2023-37267

CRITICAL
Improper Access Control (CWE-284)
2023-07-13 security-advisories@github.com
Authentication Bypass Umbraco Cms
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 13, 2023 - 14:15 nvd
CRITICAL 9.8

DescriptionNVD

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

AnalysisAI

Umbraco is a ASP.NET CMS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1. Affected products include: Umbraco Umbraco Cms.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Umbraco Cms

View all
CVE-2012-10054 CRITICAL POC
9.3 Aug 13

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx

CVE-2020-9471 HIGH POC
8.8 Mar 16

Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package
CVE-2024-10761 MEDIUM POC
6.9 Nov 04

A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. Rated medium severity (CVSS 6.9), thi
CVE-2024-55488 MEDIUM POC
6.5 Jan 22

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scrip
CVE-2020-5811 MEDIUM POC
6.5 Dec 30

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, whi
CVE-2020-9472 MEDIUM POC
6.5 Mar 16

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package f
CVE-2012-1301 CRITICAL
9.8 Apr 13

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" param
CVE-2025-67288 CRITICAL
10.0 Dec 22

Arbitrary code execution in Umbraco CMS 16.3.3 is claimed via upload of a crafted PDF file that abuses insufficient file
CVE-2020-5810 MEDIUM POC
5.4 Dec 30

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerabili
CVE-2020-5809 MEDIUM POC
5.4 Dec 30

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerabili
CVE-2021-47776 MEDIUM POC
5.3 Jan 15

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl par
CVE-2025-32017 HIGH
8.8 Apr 08

Umbraco is a free and open source .NET content management system. Rated high severity (CVSS 8.8), this vulnerability is

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-37267 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy