CVE-2020-29454

Vulnerability

CVE-2020-29454 affects Umbraco CMS versions 8.0.0 through 8.9.1. The LogViewerController endpoint was accessible to any authenticated backoffice user, even those lacking the required Applications.Settings permission [1][2]. This allowed unauthorized access to system logs.

Exploitation

Exploitation requires an authenticated backoffice session. The attacker must know the endpoint and how to call it with correct parameters, but the vendor considers the risk low [1]. The endpoint is not exposed to unauthenticated users or website visitors.

Impact

The logs may contain sensitive information such as error details, stack traces, or custom logged data. While default Umbraco logs do not allow privilege escalation, custom implementations that log passwords or other secrets could lead to privilege escalation [1]. The vendor rates severity as low, but Trustwave rated it medium.

Mitigation

The issue was fixed in Umbraco version 8.10.0 [1]. Users should upgrade to that version or later. Version 7 is not affected.