CVE-2024-43377

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-433787.8calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS throughCVE-2024-433793.1TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scannCVE-2024-433807.5fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3CVE-2024-433815.4reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site ScriptiCVE-2024-433825.9Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypCVE-2024-433838.1Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library:CVE-2024-433848.0A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.CVE-2024-433858.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemenCVE-2024-433868.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemenCVE-2024-433878.8A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RCVE-2024-433888.8A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.CVE-2024-433898.1A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIG