CVE-2024-34071 Open Redirect Bypass Protection
Authenticated attackers can exploit an open redirect in Umbraco CMS, bypassing protection mechanisms to redirect users to malicious sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34071?
CVE-2024-34071 is a medium-severity vulnerability in Umbraco Umbraco Cms, published on 21 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.
Weakness: CWE-601
Which versions are affected by CVE-2024-34071?
16 open source packages ship an affected version, including Umbraco.Cms.Web.BackOffice and UmbracoCms.Core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Cms.Web.BackOffice NuGet | From 10.5.0 | 10.8.6 |
Umbraco.Cms.Web.BackOffice NuGet | From 10.5.0 | 10.8.6 |
Umbraco.Cms.Web.BackOffice NuGet | From 12.0.0 | 12.3.10 |
Umbraco.Cms.Web.BackOffice NuGet | From 12.0.0 | 12.3.10 |
Umbraco.Cms.Web.BackOffice NuGet | From 13.0.0 | 13.3.1 |
Umbraco.Cms.Web.BackOffice NuGet | From 13.0.0 | 13.3.1 |
10 more packages
Umbraco.Cms.Web.BackOffice NuGet | From 8.18.5 | 8.18.14 |
Umbraco.Cms.Web.BackOffice NuGet | From 8.18.5 | 8.18.14 |
UmbracoCms.Core NuGet | From 10.5.0 | 10.8.6 |
UmbracoCms.Core NuGet | From 10.5.0 | 10.8.6 |
UmbracoCms.Core NuGet | From 12.0.0 | 12.3.10 |
UmbracoCms.Core NuGet | From 12.0.0 | 12.3.10 |
UmbracoCms.Core NuGet | From 13.0.0 | 13.3.1 |
UmbracoCms.Core NuGet | From 13.0.0 | 13.3.1 |
UmbracoCms.Core NuGet | From 8.18.5 | 8.18.14 |
UmbracoCms.Core NuGet | From 8.18.5 | 8.18.14 |
Products include Umbraco Umbraco Cms.
How do I fix CVE-2024-34071?
Upgrade Umbraco.Cms.Web.BackOffice to a fixed version for your release line: 10.8.6, 12.3.10, 13.3.1 or 8.18.14.
Is CVE-2024-34071 being exploited?
There is no known exploitation of CVE-2024-34071 in the wild and no public exploit code.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Sources
Also known as GHSA-j74q-mv2c-rxmp.