-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Umbraco.Cms.Api.Delivery | nuget | >= 13.0.0, <= 13.9.2 | 13.9.3 |
| Umbraco.Cms.Api.Delivery | nuget | >= 15.0.0, <= 15.4.3 | 15.4.4 |
| Umbraco.Cms.Api.Delivery | nuget | >= 16.0.0, <= 16.1.0 | 16.1.1 |
Miggo AIRoot Cause AnalysisThe security vulnerability allows unauthorized access to cached content in Umbraco's Delivery API. The root cause is the improper caching policy that does not account for the API key used in requests. When a request with a valid API key is made to a protected endpoint, the response is cached. Subsequent requests to the same endpoint, even without a valid API key, would receive the cached response, leading to an information disclosure vulnerability. The analysis of the provided patches shows that the fix is in the CacheRequestAsync method of the DeliveryApiOutputCachePolicy class. The patch introduces a check to verify if the API has public access before enabling output caching. This ensures that only responses for public content are cached, mitigating the risk of leaking sensitive information. Therefore, the CacheRequestAsync function is identified as the vulnerable function because its logic was insufficient to prevent the caching of protected content.
C#C#Ongoing coverage of React2Shell