-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Umbraco.Cms | nuget | >= 11.0.0-rc1, < 13.8.1 | 13.8.1 |
| Umbraco.Cms | nuget | < 10.8.10 | 10.8.10 |
Miggo AIRoot Cause AnalysisThe vulnerability allows user enumeration based on the timing of login responses. The provided patches (14fbd20665b453cbf094ccf4575b79a9fba07e03 and 34709be6cce9752dfa767dffbf551305f48839bc) clearly show modifications to the PostLogin method within the AuthenticationController.cs file. These changes involve adding a TimedScope to ensure that failed login attempts take a consistent amount of time, thereby preventing attackers from distinguishing between valid and invalid users based on response time. The PostLogin method is directly responsible for processing login requests and its response timing was the source of the vulnerability. The new GetLoginDuration method and the TimedScope class are part of the mitigation, not the vulnerability itself. The core vulnerable behavior was within PostLogin before these mitigations were applied.
Ongoing coverage of React2Shell