Umbraco.CMS (NuGet)
Advisories
62
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 18.0.2 or later clears every advisory below that has a fix.
Upgrade commands
dotnet
dotnet add package Umbraco.CMS --version 18.0.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-wr57-hqmp-fgvh Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion |
High EPSS 0.66% |
>= 12.0.0, < 13.15.1 | 13.15.1 |
| GHSA-wr57-hqmp-fgvh Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion |
High EPSS 0.66% |
>= 14.0.0-rc1, < 17.5.3 | 17.5.3 |
| GHSA-wr57-hqmp-fgvh Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion |
High EPSS 0.66% |
>= 18.0.0, < 18.0.2 | 18.0.2 |
| GHSA-vr9v-27gg-qgx4 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog |
Medium EPSS 0.14% |
>= 14.0.0, < 17.4.0 | 17.4.0 |
| GHSA-2qjj-h6wp-c7h7 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers |
Medium EPSS 0.18% |
>= 17.3.0-rc, < 17.4.0 | 17.4.0 |
| GHSA-2qjj-h6wp-c7h7 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers |
Medium EPSS 0.18% |
< 13.14.0 | 13.14.0 |
| GHSA-rhcg-3h8r-v6vp Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks |
High EPSS 0.36% |
>= 15.3.1, < 16.5.1 | 16.5.1 |
| GHSA-rhcg-3h8r-v6vp Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks |
High EPSS 0.36% |
>= 17.0.0, < 17.2.2 | 17.2.2 |
| GHSA-vrqc-59mw-qqg7 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering |
Medium EPSS 0.28% |
>= 17.0.0, < 17.2.2 | 17.2.2 |
| GHSA-vrqc-59mw-qqg7 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering |
Medium EPSS 0.28% |
>= 16.2.0, < 16.5.1 | 16.5.1 |
| GHSA-fpvf-fvp5-996r Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
Medium EPSS 0.19% |
>= 14.0.0, < 16.5.1 | 16.5.1 |
| GHSA-fpvf-fvp5-996r Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
Medium EPSS 0.19% |
>= 17.0.0, < 17.2.2 | 17.2.2 |
| GHSA-54mj-vcvj-q3v5 Umbraco CMS has an arbitrary file upload vulnerability |
Critical EPSS 0.55% |
<= 16.3.3 | No fix yet |
| GHSA-hfv2-pf68-m33x Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality |
Medium EPSS 0.36% |
>= 10.0.0, < 13.12.1 | 13.12.1 |
| GHSA-pgvc-6h2p-q4f6 Umbraco CMS disclosure of configured password requirements |
Medium EPSS 0.34% |
>= 10.0.0, < 10.8.11 | 10.8.11 |
| GHSA-pgvc-6h2p-q4f6 Umbraco CMS disclosure of configured password requirements |
Medium EPSS 0.34% |
>= 13.0.0, < 13.9.2 | 13.9.2 |
| GHSA-fr6r-p8hv-x3c4 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads |
Medium EPSS 0.19% |
>= 14.0.0, < 15.4.2 | 15.4.2 |
| GHSA-4g8m-5mj5-c8xg Umbraco Makes User Enumeration Feasible Based on Timing of Login Response |
Medium EPSS 0.38% |
>= 11.0.0-rc1, < 13.8.1 | 13.8.1 |
| GHSA-4g8m-5mj5-c8xg Umbraco Makes User Enumeration Feasible Based on Timing of Login Response |
Medium EPSS 0.38% |
< 10.8.10 | 10.8.10 |
| GHSA-q62r-8ppj-xvf4 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users |
High EPSS 0.65% |
>= 14.0.0--preview004, < 14.3.4 | 14.3.4 |
| GHSA-q62r-8ppj-xvf4 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users |
High EPSS 0.65% |
>= 15.0.0-rc1, < 15.3.1 | 15.3.1 |
| GHSA-hmg4-wwm5-p999 Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes |
Medium EPSS 1.61% |
>= 14.0.0, < 14.3.2 | 14.3.2 |
| GHSA-hmg4-wwm5-p999 Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes |
Medium EPSS 1.61% |
>= 15.0.0, < 15.1.2 | 15.1.2 |
| GHSA-69cg-w8vm-h229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge |
Medium EPSS 0.61% |
>= 15.0.0, < 15.1.2 | 15.1.2 |
| GHSA-69cg-w8vm-h229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge |
Medium EPSS 0.61% |
>= 10.8.7, < 10.8.8 | 10.8.8 |
| GHSA-69cg-w8vm-h229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge |
Medium EPSS 0.61% |
>= 11.0.0, < 13.5.3 | 13.5.3 |
| GHSA-69cg-w8vm-h229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge |
Medium EPSS 0.61% |
>= 14.0.0, < 14.3.2 | 14.3.2 |
| GHSA-wxw9-6pv9-c3xc Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out |
Medium EPSS 0.27% |
>= 10.0.0, < 10.8.7 | 10.8.7 |
| GHSA-wxw9-6pv9-c3xc Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out |
Medium EPSS 0.27% |
>= 13.0.0, < 13.5.2 | 13.5.2 |
| GHSA-5955-cwv4-h7qh Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice |
Medium EPSS 0.47% |
>= 10.0.0, < 10.8.7 | 10.8.7 |
| GHSA-5955-cwv4-h7qh Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice |
Medium EPSS 0.47% |
>= 13.0.0, < 13.5.2 | 13.5.2 |
| GHSA-fp6q-gccw-7qqm Umbraco CMS logout page displayed before session expiration |
Low EPSS 0.27% |
>= 13.0.0, < 13.5.2 | 13.5.2 |
| GHSA-fp6q-gccw-7qqm Umbraco CMS logout page displayed before session expiration |
Low EPSS 0.27% |
>= 10.0.0, < 10.8.7 | 10.8.7 |
| GHSA-4gp9-ff99-j6vj Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API |
Medium EPSS 0.38% |
>= 14.0.0, < 14.3.0 | 14.3.0 |
| GHSA-hrww-x3fq-xcvh Umbraco CMS Improper Access Control vulnerability |
Medium EPSS 0.24% |
>= 14.0.0, < 14.1.2 | 14.1.2 |
| GHSA-6xmx-85x3-4cv2 Stored XSS via SVG File Upload |
Medium EPSS 0.39% |
>= 7.0.0, < 7.15.11 | 7.15.11 |
| GHSA-6xmx-85x3-4cv2 Stored XSS via SVG File Upload |
Medium EPSS 0.39% |
>= 12.0.0, < 12.2.0 | 12.2.0 |
| GHSA-6xmx-85x3-4cv2 Stored XSS via SVG File Upload |
Medium EPSS 0.39% |
>= 11.0.0, < 11.5.0 | 11.5.0 |
| GHSA-6xmx-85x3-4cv2 Stored XSS via SVG File Upload |
Medium EPSS 0.39% |
>= 9.0.0, < 10.7.0 | 10.7.0 |
| GHSA-6xmx-85x3-4cv2 Stored XSS via SVG File Upload |
Medium EPSS 0.39% |
>= 8.0.0, < 8.18.9 | 8.18.9 |
| GHSA-7x74-h8cw-qhxq Brute force exploit can be used to collect valid usernames |
Medium EPSS 0.50% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-7x74-h8cw-qhxq Brute force exploit can be used to collect valid usernames |
Medium EPSS 0.50% |
>= 9.0.0, < 10.8.1 | 10.8.1 |
| GHSA-7x74-h8cw-qhxq Brute force exploit can be used to collect valid usernames |
Medium EPSS 0.50% |
>= 11.0.0, < 12.3.4 | 12.3.4 |
| GHSA-8qp8-9rpw-j46c SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email. |
Medium EPSS 0.46% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-8qp8-9rpw-j46c SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email. |
Medium EPSS 0.46% |
>= 9.0.0, < 10.8.1 | 10.8.1 |
| GHSA-8qp8-9rpw-j46c SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email. |
Medium EPSS 0.46% |
>= 11.0.0, < 12.3.4 | 12.3.4 |
| GHSA-cfr5-7p54-4qg8 Privilege Escalation using Spoofing |
Medium EPSS 0.37% |
>= 9.0.0, < 10.8.1 | 10.8.1 |
| GHSA-cfr5-7p54-4qg8 Privilege Escalation using Spoofing |
Medium EPSS 0.37% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-cfr5-7p54-4qg8 Privilege Escalation using Spoofing |
Medium EPSS 0.37% |
>= 11.0.0, < 12.3.4 | 12.3.4 |
| GHSA-6324-52pr-h4p5 Using the directory back payload (“/../”) in a package name allows placement of package in other folders. |
Medium EPSS 0.62% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-6324-52pr-h4p5 Using the directory back payload (“/../”) in a package name allows placement of package in other folders. |
Medium EPSS 0.62% |
>= 9.0.0, < 10.8.1 | 10.8.1 |
| GHSA-6324-52pr-h4p5 Using the directory back payload (“/../”) in a package name allows placement of package in other folders. |
Medium EPSS 0.62% |
>= 11.0.0, < 12.3.4 | 12.3.4 |
| GHSA-v98m-398x-269r DOM-XSS on Backoffice login screen. |
Medium EPSS 0.43% |
>= 11.0.0, < 12.3.4 | 12.3.4 |
| GHSA-v98m-398x-269r DOM-XSS on Backoffice login screen. |
Medium EPSS 0.43% |
>= 10.0.0, < 10.8.1 | 10.8.1 |
| GHSA-335x-5wcm-8jv2 Backoffice User can bypass "Publish" restriction |
Medium EPSS 0.41% |
>= 9.0.0, < 10.8.0 | 10.8.0 |
| GHSA-335x-5wcm-8jv2 Backoffice User can bypass "Publish" restriction |
Medium EPSS 0.41% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-335x-5wcm-8jv2 Backoffice User can bypass "Publish" restriction |
Medium EPSS 0.41% |
>= 11.0.0, < 12.3.0 | 12.3.0 |
| GHSA-xxc6-35r7-796w Possible injection of HTML into user invite mails |
Medium EPSS 0.41% |
>= 9.0.0, < 10.7.0 | 10.7.0 |
| GHSA-xxc6-35r7-796w Possible injection of HTML into user invite mails |
Medium EPSS 0.41% |
>= 8.0.0, < 8.18.10 | 8.18.10 |
| GHSA-xxc6-35r7-796w Possible injection of HTML into user invite mails |
Medium EPSS 0.41% |
>= 11.0.0, < 12.1.0 | 12.1.0 |
| GHSA-x34j-wxq8-7vcm Umbraco CMS vulnerable to CSRF |
High EPSS 11.15% |
< 7.4.0 | 7.4.0 |
| GHSA-5f6p-4hxq-rjxm Umbraco CMS vulnerable to CSRF |
High EPSS 0.62% |
< 7.4.0 | 7.4.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor