CVE-2023-37267:
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.53941%
CWE
Published
7/13/2023
Updated
11/4/2023
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Umbraco.Cms.Infrastructure | nuget | >= 9.0.0, < 10.6.1 | 10.6.1 |
| Umbraco.Cms.Infrastructure | nuget | >= 11.0.0, < 11.4.2 | 11.4.2 |
| Umbraco.Cms.Infrastructure | nuget | = 12.0.0 | 12.0.1 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 9.0.0, < 10.6.1 | 10.6.1 |
| Umbraco.Cms.Web.BackOffice | nuget | >= 11.0.0, < 11.4.2 | 11.4.2 |
| Umbraco.Cms.Web.BackOffice | nuget | = 12.0.0 | 12.0.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from two key behaviors: 1) The CompleteInstall method's auto-login feature after restart when in Install mode, which bypassed authentication. 2) The runtime state transitioning to Install mode when detecting database issues, enabling the attack surface. The commit diff shows removal of IBackOfficeSignInManager dependencies and auto-login logic in CompleteInstall, plus hardening of runtime state transitions in DetermineRuntimeLevel. These changes directly address the authentication bypass and improper state management described in the advisory.