« Volver al listado

CVE-2024-32872

Estado: AplazadaMedia (5.5)—

Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Umbraco — PlumberAIUmbraco — WorkflowAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32872",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32872",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T17:17:40.848568Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "umbraco",
          "product": "Umbraco.Workflow.Issues",
          "versions": [
            {
              "status": "affected",
              "version": "< 10.3.9"
            },
            {
              "status": "affected",
              "version": ">= 11.0.0-rc1, < 12.2.6"
            },
            {
              "status": "affected",
              "version": ">= 13.0.0-rc1, < 13.0.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-04-24T15:15:48.003",
  "references": [
    {
      "url": "https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue."
    },
    {
      "lang": "es",
      "value": "El flujo de trabajo de Umbraco proporciona flujos de trabajo para el sistema de gestión de contenidos de Umbraco. Antes de las versiones 10.3.9, 12.2.6 y 13.0.6, un usuario de Umbraco Backoffice puede modificar las solicitudes a un endpoint API particular para incluir SQL, que será ejecutado por el servidor. Las versiones 10.3.9, 12.2.6, 13.0.6 de Umbraco Workflow, así como la versión 10.1.2 de Umbraco Plumber, contienen un parche para este problema."
    }
  ],
  "lastModified": "2026-06-17T07:30:35.603",
  "sourceIdentifier": "security-advisories@github.com"
}