CVE-2023-48227

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

U

mbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.

References

Link	Resource
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2	URL Repurposed
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2	URL Repurposed

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:umbraco:umbraco_cms::::::::
	cpe:2.3:a:umbraco:umbraco_cms::::::::
	cpe:2.3:a:umbraco:umbraco_cms::::::::

History

21 Nov 2024, 08:31

Type	Values Removed	Values Added
References	~~() https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2 - URL Repurposed~~	() https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2 - URL Repurposed

Information

Published : 2023-12-12 17:15

Updated : 2024-11-21 08:31

NVD link : CVE-2023-48227

Mitre link : CVE-2023-48227

CVE.ORG link : CVE-2023-48227

JSON object : View

Products Affected

umbraco_cms

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-48227", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-12-12T17:15:08.143", "references": [{"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2", "tags": ["URL Repurposed"], "source": "[email protected]"}, {"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2", "tags": ["URL Repurposed"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available."}, {"lang": "es", "value": "Umbraco es un sistema de gesti\u00f3n de contenidos (CMS) ASP.NET. A partir de la versi\u00f3n 8.0.0 y anteriores a las versiones 8.18.10, 10.7.0 y 12.3.0, los usuarios de Backoffice con permiso de env\u00edo para aprobaci\u00f3n pero sin permiso de publicaci\u00f3n pueden publicar en algunos escenarios. Las versiones 8.18.10, 10.7.0 y 12.3.0 contienen un parche para este problema. No hay workarounds disponibles."}], "lastModified": "2024-11-21T08:31:15.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAFFD03D-00A2-4AA4-A727-FA10CFC1446F", "versionEndExcluding": "8.18.10", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC51790C-3B57-4147-B030-A03396838BDE", "versionEndExcluding": "10.7.0", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CB794A3-A6F2-4813-9EC7-1DDA2863C598", "versionEndExcluding": "12.3.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}