NuGet package
umbraco.cms.web.backoffice
pkg:nuget/umbraco.cms.web.backoffice
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-27602 | — | < 10.8.9 | 10.8.9 | Mar 11, 2025 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media | ||
| CVE-2024-34071 | — | >= 8.18.5, < 8.18.14 | 8.18.14 | May 21, 2024 | Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in vers | ||
| CVE-2024-29035 | — | >= 13.0.0, < 13.1.1 | 13.1.1 | Apr 17, 2024 | Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1. | ||
| CVE-2023-37267 | — | >= 9.0.0, < 10.6.1 | 10.6.1 | Jul 13, 2023 | Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1. |
- CVE-2025-27602Mar 11, 2025affected < 10.8.9fixed 10.8.9
Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media
- CVE-2024-34071May 21, 2024affected >= 8.18.5, < 8.18.14fixed 8.18.14
Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in vers
- CVE-2024-29035Apr 17, 2024affected >= 13.0.0, < 13.1.1fixed 13.1.1
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
- CVE-2023-37267Jul 13, 2023affected >= 9.0.0, < 10.6.1fixed 10.6.1
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.