VDB
Sign up
MEDIUM6.1

GHSA-j74q-mv2c-rxmp

Umbraco CMS Open Redirect Bypass Protection

Quick fix

GHSA-j74q-mv2c-rxmp — UmbracoCms.Core: upgrade to the fixed version with the command below.

dotnet add package UmbracoCms.Core --version 8.18.14

Details

### Impact Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed.

### Affected Version

\>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0

### Patches 8.18.14, 10.8.6, 12.3.10, 13.3.1

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/UmbracoCms.Core
Introduced in: 8.18.5Fixed in: 8.18.14
Fixdotnet add package UmbracoCms.Core --version 8.18.14
NuGet/UmbracoCms.Core
Introduced in: 10.5.0Fixed in: 10.8.6
Fixdotnet add package UmbracoCms.Core --version 10.8.6
NuGet/UmbracoCms.Core
Introduced in: 12.0.0Fixed in: 12.3.10
Fixdotnet add package UmbracoCms.Core --version 12.3.10
NuGet/UmbracoCms.Core
Introduced in: 13.0.0Fixed in: 13.3.1
Fixdotnet add package UmbracoCms.Core --version 13.3.1
NuGet/Umbraco.Cms.Web.BackOffice
Introduced in: 8.18.5Fixed in: 8.18.14
Fixdotnet add package Umbraco.Cms.Web.BackOffice --version 8.18.14
NuGet/Umbraco.Cms.Web.BackOffice
Introduced in: 10.5.0Fixed in: 10.8.6
Fixdotnet add package Umbraco.Cms.Web.BackOffice --version 10.8.6
NuGet/Umbraco.Cms.Web.BackOffice
Introduced in: 12.0.0Fixed in: 12.3.10
Fixdotnet add package Umbraco.Cms.Web.BackOffice --version 12.3.10
NuGet/Umbraco.Cms.Web.BackOffice
Introduced in: 13.0.0Fixed in: 13.3.1
Fixdotnet add package Umbraco.Cms.Web.BackOffice --version 13.3.1

References