CVE-2023-49273 Umbraco CMS vulnerable to Privilege Escalation using Spoofing

Medium 5.4 Published 12 Dec 2023 Updated 2 Aug 2024

Low-privilege users can access unintended endpoints in Umbraco CMS, leading to privilege escalation; administrators should apply available patches.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-49273?

CVE-2023-49273 is a medium-severity vulnerability in Umbraco Umbraco Cms, published on 12 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

Weakness: CWE-863

Which versions are affected by CVE-2023-49273?

6 open source packages ship an affected version, including Umbraco.CMS. It affects 1 product.

Package	Affected	Fixed in
`Umbraco.CMS` NuGet	From `11.0.0`	`12.3.4`
`Umbraco.CMS` NuGet	From `11.0.0`	`12.3.4`
`Umbraco.CMS` NuGet	From `8.0.0`	`8.18.10`
`Umbraco.CMS` NuGet	From `8.0.0`	`8.18.10`
`Umbraco.CMS` NuGet	From `9.0.0`	`10.8.1`
`Umbraco.CMS` NuGet	From `9.0.0`	`10.8.1`

Products include Umbraco Umbraco Cms.

How do I fix CVE-2023-49273?

Upgrade Umbraco.CMS to a fixed version for your release line: 12.3.4, 8.18.10 or 10.8.1.

Is CVE-2023-49273 being exploited?

There is no known exploitation of CVE-2023-49273 in the wild and no public exploit code.

All Umbraco Umbraco Cms vulnerabilities

Sources

Also known as GHSA-cfr5-7p54-4qg8.