CVE-2024-48929— Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-48929
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Source: NVD (National Vulnerability Database)
Vulnerability Description
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
会话固定
Source: NVD (National Vulnerability Database)
Vulnerability Title
Umbraco CMS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Umbraco CMS是丹麦Umbraco公司的一个内容管理系统。 Umbraco CMS存在授权问题漏洞，该漏洞源于在显式注销期间，服务器会话不会完全终止。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| umbraco | Umbraco-CMS | >= 13.0.0, < 13.5.2 | - |
II. Public POCs for CVE-2024-48929
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-48929
请登录查看更多情报信息。
Same Patch Batch · umbraco · 2024-10-22 · 5 CVEs total
| CVE-2024-48927 | 4.6 MEDIUM | Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice |
| CVE-2024-48926 | 4.2 MEDIUM | Umbraco CMS logout page displayed before session expiration |
| CVE-2024-47819 | 4.2 MEDIUM | Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictiona |
| CVE-2024-48925 | Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Web |
IV. Related Vulnerabilities
Same product: Umbraco-CMS
- CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin - CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss - CVE-2026-31832
Umbraco Backoffice API Allows Unauthorized Modification of D - CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Ex - CVE-2025-54425
Umbraco's Delivery API allows for cached requests to be retu
Same vendor: umbraco
- CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin - CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss - CVE-2026-31832
Umbraco Backoffice API Allows Unauthorized Modification of D - CVE-2026-27449
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple - CVE-2026-24687
Umbraco.Forms has path traversal and file enumeration vulner
Same weakness: CWE-384
- CVE-2025-46605
Dell PowerProtect Data Domain（Dell PowerProtect DD） 安全漏洞 - CVE-2026-31940
Session Fixation in Chamilo LMS - CVE-2026-33946
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream - CVE-2026-33757
OpenBao lacks user confirmation for OIDC direct callback mod - CVE-2026-25101
Session Fixation in Bludit
V. Comments for CVE-2024-48929
No comments yet