ByteOS Network

NVD Vulnerability Details :

CVE-2024-48926

Analyzed

Source-security-advisories@github.com

Published At-22 Oct, 2024 | 16:15

Updated At-25 Oct, 2024 | 16:19

Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.1	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Secondary	3.1	4.2	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CPE Matches

Umbraco A/S (Umbraco)

>>umbraco_cms>>Versions from 8.0(inclusive) to 8.18.15(exclusive)

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Umbraco A/S (Umbraco)

>>umbraco_cms>>Versions from 10.0(inclusive) to 10.8.7(exclusive)

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Umbraco A/S (Umbraco)

>>umbraco_cms>>Versions from 13.0(inclusive) to 13.5.2(exclusive)

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-613	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fp6q-gccw-7qqm	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History