VDB
Sign up
LOW3.7

GHSA-8qp8-9rpw-j46c

SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.

Quick fix

GHSA-8qp8-9rpw-j46c — Umbraco.CMS: upgrade to the fixed version with the command below.

dotnet add package Umbraco.CMS --version 8.18.10

Details

#### Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled

#### Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/Umbraco.CMS
Introduced in: 8.0.0Fixed in: 8.18.10
Fixdotnet add package Umbraco.CMS --version 8.18.10
NuGet/Umbraco.CMS
Introduced in: 9.0.0Fixed in: 10.8.1
Fixdotnet add package Umbraco.CMS --version 10.8.1
NuGet/Umbraco.CMS
Introduced in: 11.0.0Fixed in: 12.3.4
Fixdotnet add package Umbraco.CMS --version 12.3.4

References