What is GHSA-8qp8-9rpw-j46c?

GHSA-8qp8-9rpw-j46c is a security advisory published by GitHub Security Advisories with Low severity. SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.

Which CVE IDs does GHSA-8qp8-9rpw-j46c cover?

GHSA-8qp8-9rpw-j46c covers the following CVE IDs: CVE-2023-49274. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8qp8-9rpw-j46c?

GHSA-8qp8-9rpw-j46c has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-8qp8-9rpw-j46c?

GHSA-8qp8-9rpw-j46c affects 3 products, including: nuget/Umbraco.CMS:\u003e= 8.0.0, \u003c 8.18.10; nuget/Umbraco.CMS:\u003e= 9.0.0, \u003c 10.8.1; nuget/Umbraco.CMS:\u003e= 11.0.0, \u003c 12.3.4.

GHSA-8qp8-9rpw-j46cLowCVSS 3.7

SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.

Vendor

GitHub Security Advisories

Published

December 13, 2023

Last Modified

January 12, 2024

🔗 CVE IDs covered (1)

CVE-2023-49274 →

📋 Description

Impact

A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled

Explanation of the vulnerability

Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.

🎯 Affected products3

nuget/Umbraco.CMS:>= 8.0.0, < 8.18.10
nuget/Umbraco.CMS:>= 9.0.0, < 10.8.1
nuget/Umbraco.CMS:>= 11.0.0, < 12.3.4

🔗 References (3)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-8qp8-9rpw-j46c
https://nvd.nist.gov/vuln/detail/CVE-2023-49274
https://github.com/advisories/GHSA-8qp8-9rpw-j46c