CVE-2024-34071

{"id": "CVE-2024-34071", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-05-21T14:15:11.783", "references": [{"url": "https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450", "source": "security-advisories@github.com"}, {"url": "https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f", "source": "security-advisories@github.com"}, {"url": "https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031", "source": "security-advisories@github.com"}, {"url": "https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024", "source": "security-advisories@github.com"}, {"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1."}, {"lang": "es", "value": "Umbraco es un CMS ASP.NET utilizado por m\u00e1s de 730.000 sitios web. Umbraco tiene un endpoint que es vulnerable a redireccionamientos abiertos. El endpoint est\u00e1 protegido, por lo que requiere que el usuario inicie sesi\u00f3n en el backoffice antes de que la vulnerabilidad quede expuesta. Esta vulnerabilidad ha sido parcheada en las versiones 8.18.14, 10.8.6, 12.3.10 y 13.3.1."}], "lastModified": "2024-05-21T16:54:26.047", "sourceIdentifier": "security-advisories@github.com"}