CVE-2023-32312— Client secret not mandatory in UmbracoIdentityExtensions
Quick assessment
Affected
umbraco UmbracoIdentityExtensions
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
UmbracoIdentityExtensions是丹麦Umbraco公司的一个 Umbraco 附加包。 UmbracoIdentityExtensions存在信息泄露漏洞，该漏洞源于不需要客户端密钥，这可能会将某些端点暴露给不受信任的参与者。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-32312
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Client secret not mandatory in UmbracoIdentityExtensions
Source: CVE Program / CVE List V5
Vulnerability Description
UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
UmbracoIdentityExtensions 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
UmbracoIdentityExtensions是丹麦Umbraco公司的一个 Umbraco 附加包。 UmbracoIdentityExtensions存在信息泄露漏洞，该漏洞源于不需要客户端密钥，这可能会将某些端点暴露给不受信任的参与者。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| umbraco | UmbracoIdentityExtensions | <= 2.0.0 | - |
|
II. Public POCs for CVE-2023-32312
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-32312
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-32312 (2)
-
https://github.com/umbraco/UmbracoIdentityExtensions/pull/53 x_refsource_MISC
Vendor Advisories for CVE-2023-32312 (1)
Other References for CVE-2023-32312 (1)
IV. Related Vulnerabilities
Same vendor: umbraco
-
CVE-2026-69197
Umbraco: Delivery API leaks protected (Public Access) conten -
CVE-2026-46609
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confir -
CVE-2026-46616
Umbraco.Cms: Open Redirect Vulnerability in Surface Controll -
CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin -
CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss
Same weakness: CWE-200
-
CVE-2026-105120
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sess -
CVE-2026-71883
Native AES packet cipher returns the raw AES key on an alias -
CVE-2026-100149
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share -
CVE-2026-105030
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via -
CVE-2026-104476
Backdrop CMS before 1.35.1 Information Disclosure via Config
V. Comments for CVE-2023-32312
No comments yet