CVE-2024-43376

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-433774.3Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.CVE-2024-433787.8calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through CVE-2024-433793.1TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scann CVE-2024-433807.5fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3 CVE-2024-433815.4reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripti CVE-2024-433825.9Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encryp CVE-2024-433838.1Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library:CVE-2024-433848.0A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.CVE-2024-433858.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemen CVE-2024-433868.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemen CVE-2024-433878.8A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_R CVE-2024-433888.8A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.