Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Vulnerability Description
Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Vulnerability Type
授权机制不恰当
Vulnerability Title
Umbraco 安全漏洞
Vulnerability Description
Umbraco是丹麦Umbraco公司的一套C#编写的开源的内容管理系统（CMS）。 Umbraco 10.8.9版本和13.7.1版本之前版本存在安全漏洞，该漏洞源于通过操纵后台API URL，可能导致检索或删除无权访问的内容或媒体。
CVSS Information
N/A
Vulnerability Type
N/A