Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Umbraco CMS login page can reveal usernames

CVE-2024-28868 · published 2 years ago
Summary

The built‑in login screen in Umbraco version 10 before 10.8.4 can let an attacker find out which user names exist in the system. Knowing valid usernames makes it easier for attackers to try password guessing or other attacks. Update to version 10.8.5 or later, or disable the native login screen and use only external authentication methods.

What to do
  • Update umbraco hq umbracocms to version 10.8.5.
  • Update umbraco umbraco_cms to version 10.8.5 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget umbraco hq umbracocms >= 10.0.0, < 10.8.5
Fix: upgrade to 10.8.5
– umbraco umbraco_cms >= 10.0.0, < 10.8.5
cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*
Original advisory text
Umbraco possible user enumeration vulnerability
Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-203Observable Discrepancy
CWE-204Observable Response Discrepancy
Timeline
Published20 Mar 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-552f-97wf-pmpq · GHSA
CVE-2024-28868 · NVD
CVE-2024-28868 · OSV
Track software like this
Free during beta