Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-ehsc-c1uh-tua1
Summary
Exposure of Sensitive Information to an Unauthorized Actor
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
Aliases
0
alias CVE-2023-49278
1
alias GHSA-7x74-h8cw-qhxq
Fixed_packages
0
url pkg:nuget/UmbracoCms@8.18.10
purl pkg:nuget/UmbracoCms@8.18.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.18.10
1
url pkg:nuget/UmbracoCms@10.8.1
purl pkg:nuget/UmbracoCms@10.8.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@10.8.1
2
url pkg:nuget/UmbracoCms@12.3.4
purl pkg:nuget/UmbracoCms@12.3.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@12.3.4
3
url pkg:nuget/Umbraco.CMS@8.18.10
purl pkg:nuget/Umbraco.CMS@8.18.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@8.18.10
4
url pkg:nuget/Umbraco.CMS@10.8.1
purl pkg:nuget/Umbraco.CMS@10.8.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@10.8.1
5
url pkg:nuget/Umbraco.CMS@12.3.4
purl pkg:nuget/Umbraco.CMS@12.3.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@12.3.4
Affected_packages
0
url pkg:nuget/UmbracoCms@8.0.0
purl pkg:nuget/UmbracoCms@8.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-2cmy-5q87-5bgb
2
vulnerability VCID-2e5t-qrxu-6bhc
3
vulnerability VCID-6hye-45tx-auc9
4
vulnerability VCID-azpt-qmk7-1ueu
5
vulnerability VCID-e5g9-xgrk-eqaf
6
vulnerability VCID-ehsc-c1uh-tua1
7
vulnerability VCID-s3pr-pezb-4qf4
8
vulnerability VCID-wtw6-zcw6-2yd2
9
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@8.0.0
1
url pkg:nuget/UmbracoCms@10.0.0
purl pkg:nuget/UmbracoCms@10.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-2exh-k5tm-r3cy
2
vulnerability VCID-6hye-45tx-auc9
3
vulnerability VCID-azpt-qmk7-1ueu
4
vulnerability VCID-ehsc-c1uh-tua1
5
vulnerability VCID-fde1-sjng-6qfw
6
vulnerability VCID-m8gs-zxzd-e3hu
7
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@10.0.0
2
url pkg:nuget/UmbracoCms@12.0.0
purl pkg:nuget/UmbracoCms@12.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-2exh-k5tm-r3cy
2
vulnerability VCID-6hye-45tx-auc9
3
vulnerability VCID-azpt-qmk7-1ueu
4
vulnerability VCID-ehsc-c1uh-tua1
5
vulnerability VCID-m8gs-zxzd-e3hu
6
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@12.0.0
3
url pkg:nuget/Umbraco.CMS@8.0.0
purl pkg:nuget/Umbraco.CMS@8.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-6hye-45tx-auc9
2
vulnerability VCID-azpt-qmk7-1ueu
3
vulnerability VCID-ehsc-c1uh-tua1
4
vulnerability VCID-s3pr-pezb-4qf4
5
vulnerability VCID-wtw6-zcw6-2yd2
6
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@8.0.0
4
url pkg:nuget/Umbraco.CMS@9.0.0
purl pkg:nuget/Umbraco.CMS@9.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-6hye-45tx-auc9
2
vulnerability VCID-azpt-qmk7-1ueu
3
vulnerability VCID-ehsc-c1uh-tua1
4
vulnerability VCID-s3pr-pezb-4qf4
5
vulnerability VCID-wtw6-zcw6-2yd2
6
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@9.0.0
5
url pkg:nuget/Umbraco.CMS@11.0.0
purl pkg:nuget/Umbraco.CMS@11.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1rkh-7s4e-vyen
1
vulnerability VCID-2exh-k5tm-r3cy
2
vulnerability VCID-6hye-45tx-auc9
3
vulnerability VCID-azpt-qmk7-1ueu
4
vulnerability VCID-ehsc-c1uh-tua1
5
vulnerability VCID-s3pr-pezb-4qf4
6
vulnerability VCID-wtw6-zcw6-2yd2
7
vulnerability VCID-xu9a-vwjv-5ycb
resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@11.0.0
References
0
reference_url https://github.com/umbraco/Umbraco-CMS
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/umbraco/Umbraco-CMS
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49278
reference_id CVE-2023-49278
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49278
2
reference_url https://github.com/advisories/GHSA-7x74-h8cw-qhxq
reference_id GHSA-7x74-h8cw-qhxq
reference_type
scores
url https://github.com/advisories/GHSA-7x74-h8cw-qhxq
3
reference_url https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-7x74-h8cw-qhxq
reference_id GHSA-7x74-h8cw-qhxq
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-7x74-h8cw-qhxq
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 200
name Exposure of Sensitive Information to an Unauthorized Actor
description The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 307
name Improper Restriction of Excessive Authentication Attempts
description The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Exploits
Severity_range_score0.0 - 3
Exploitability0.5
Weighted_severity2.7
Risk_score1.4
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-ehsc-c1uh-tua1