{"id":"GHSA-j74q-mv2c-rxmp","summary":"Umbraco CMS Open Redirect Bypass Protection  ","details":"### Impact\nUmbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed.\n\n### Affected Version\n\n\\\u003e= 8.18.5, \u003e= 10.5.0, \u003e= 12.0.0, \u003e= 13.0.0\n\n### Patches\n8.18.14, 10.8.6, 12.3.10, 13.3.1","aliases":["CVE-2024-34071"],"modified":"2026-09-10T03:49:23.703892796Z","published":"2024-05-21T14:29:18Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-05-21T14:29:18Z","nvd_published_at":"2024-05-21T14:15:11Z","cwe_ids":["CWE-601"]},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-j74q-mv2c-rxmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34071"},{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/commit/5f24de308584b9771240a6db1a34630a5114c450"},{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/commit/c17d4e1a600098ec524e4126f4395255476bc33f"},{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/commit/c8f71af646171074c13e5c34f74312def4512031"},{"type":"WEB","url":"https://github.com/umbraco/Umbraco-CMS/commit/d8df405db4ea884bb4b96f088d10d9a2070cf024"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco-CMS"}],"affected":[{"package":{"name":"UmbracoCms.Core","ecosystem":"NuGet","purl":"pkg:nuget/UmbracoCms.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.5"},{"fixed":"8.18.14"}]}],"versions":["8.18.10","8.18.11","8.18.12","8.18.13","8.18.5","8.18.6","8.18.7","8.18.8","8.18.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"UmbracoCms.Core","ecosystem":"NuGet","purl":"pkg:nuget/UmbracoCms.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.5.0"},{"fixed":"10.8.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"UmbracoCms.Core","ecosystem":"NuGet","purl":"pkg:nuget/UmbracoCms.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"UmbracoCms.Core","ecosystem":"NuGet","purl":"pkg:nuget/UmbracoCms.Core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"Umbraco.Cms.Web.BackOffice","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.BackOffice"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.5"},{"fixed":"8.18.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"Umbraco.Cms.Web.BackOffice","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.BackOffice"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.5.0"},{"fixed":"10.8.6"}]}],"versions":["10.5.0","10.5.1","10.6.0","10.6.0-rc","10.6.1","10.7.0","10.7.0-rc","10.8.0","10.8.0-rc","10.8.1","10.8.2","10.8.3","10.8.4","10.8.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"Umbraco.Cms.Web.BackOffice","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.BackOffice"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.3.10"}]}],"versions":["12.0.0","12.0.1","12.1.0","12.1.0-rc","12.1.1","12.1.2","12.2.0","12.2.0-rc","12.3.0","12.3.0-rc","12.3.1","12.3.2","12.3.3","12.3.4","12.3.5","12.3.6","12.3.7","12.3.8","12.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}},{"package":{"name":"Umbraco.Cms.Web.BackOffice","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Cms.Web.BackOffice"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.3.1"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.0.3","13.1.0","13.1.0-rc","13.1.1","13.2.0","13.2.0-rc","13.2.1","13.2.2","13.3.0","13.3.0-rc"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-j74q-mv2c-rxmp/GHSA-j74q-mv2c-rxmp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}