What is GHSA-hmg4-wwm5-p999?

GHSA-hmg4-wwm5-p999 is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

Which CVE IDs does GHSA-hmg4-wwm5-p999 cover?

GHSA-hmg4-wwm5-p999 covers the following CVE IDs: CVE-2025-24011. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hmg4-wwm5-p999?

GHSA-hmg4-wwm5-p999 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hmg4-wwm5-p999?

GHSA-hmg4-wwm5-p999 affects 2 products, including: nuget/Umbraco.Cms:\u003e= 14.0.0, \u003c 14.3.2; nuget/Umbraco.Cms:\u003e= 15.0.0, \u003c 15.1.2.

GHSA-hmg4-wwm5-p999MediumCVSS 5.3

Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

Vendor

GitHub Security Advisories

Published

January 21, 2025

Last Modified

April 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-24011 →

📋 Description

Impact

Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists.

Patches

Patched in 14.3.2 and 15.1.2.

Workarounds

None available.

🎯 Affected products2

nuget/Umbraco.Cms:>= 14.0.0, < 14.3.2
nuget/Umbraco.Cms:>= 15.0.0, < 15.1.2

🔗 References (5)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999
https://nvd.nist.gov/vuln/detail/CVE-2025-24011
https://github.com/umbraco/Umbraco-CMS/commit/559c6c9f312df1d6eb1bde82c4b81c0896da6382
https://github.com/umbraco/Umbraco-CMS/commit/839b6816f2ae3e5f54459a0f09dad6b17e2d1e07
https://github.com/advisories/GHSA-hmg4-wwm5-p999