5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49147

CVE-2025-49147: Umbraco CMS disclosure of configured password requirements

Impact

Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password.

The vulnerability can be found in the supported Umbraco versions 10 and 13. It was not exposed in Umbraco 7 or 8, nor in 14 or higher versions.

Patches

Patched in 10.8.11 and 13.9.2

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49147

CVE-2025-49147:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.Cms	nuget	>= 10.0.0, < 10.8.11	10.8.11
Umbraco.Cms	nuget	>= 13.0.0, < 13.9.2	13.9.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commits clearly indicates that the vulnerability lies within the GetPasswordConfig method in AuthenticationController.cs. The vulnerability description states that an anonymously authenticated endpoint can retrieve password requirement information. The code patches confirm this by altering the logic of the GetPasswordConfig function.

Before the patch, the function would return password configuration details even if the user was not authenticated. The line currentUserId.Success ? currentUserId.Result != userId : true is the culprit; for an unauthenticated user, currentUserId.Success is false, which resulted in _passwordConfiguration.GetConfiguration(true) being executed, thereby leaking the password policy.

The fix introduces a session-based check (HasActivePasswordResetFlowSession) to ensure that password configuration is only revealed during a legitimate password reset process. For any other unauthenticated request, the function now returns an empty dictionary, effectively patching the information disclosure vulnerability. The other modified functions (PostLogin, PostRequestPasswordReset, PostSetPassword, ValidatePasswordResetCode) and the new extension methods in HttpContextExtensions.cs are all part of the mitigation logic to manage the password reset session state and are not themselves vulnerable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.