« Volver al listado

CVE-2023-49089

Estado: ModificadaMedia (6.5)—

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Umbraco — Umbraco CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49089",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "umbraco",
          "product": "Umbraco-CMS",
          "versions": [
            {
              "status": "affected",
              "version": ">= 8.0.0, < 8.18.10"
            },
            {
              "status": "affected",
              "version": ">= 9.0.0-rc001, < 10.8.1"
            },
            {
              "status": "affected",
              "version": ">= 11.0.0-rc1, < 12.3.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-12T19:15:07.840",
  "references": [
    {
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue."
    },
    {
      "lang": "es",
      "value": "Umbraco es un sistema de gestión de contenidos (CMS) ASP.NET. A partir de la versión 8.0.0 y anteriores a las versiones 8.18.10, 10.8.1 y 12.3.0, los usuarios de Backoffice con permisos para crear paquetes pueden utilizar el path traversal y, por lo tanto, escribir fuera de la ubicación esperada. Las versiones 8.18.10, 10.8.1 y 12.3.0 contienen un parche para este problema."
    }
  ],
  "lastModified": "2026-06-17T06:35:20.583",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAFFD03D-00A2-4AA4-A727-FA10CFC1446F",
              "versionEndExcluding": "8.18.10",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03FE24B3-A0E4-4235-B990-51E9B6F877F5",
              "versionEndExcluding": "10.8.1",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6F87B7F-5070-4696-983D-42326E61B2E6",
              "versionEndExcluding": "12.3.0",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}