CVE-2023-49274

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-49274
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49274.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-49274
Aliases
Published
2023-12-12T19:10:46.262Z
Modified
2025-11-29T15:04:53.071680Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Umbraco CMS SMTP misconfiguration exposes potential registered user email
Details

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49274.json",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
b8db430615d76521a4394a23f9928dc7c12f87bd
Fixed
365621023a2e12975104de36e1cbec0829d82804
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.18.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
4f06c1f33a54daf4752a439778626202960db68c
Fixed
4a7ad4a562e7f07641d4a33cd246509f4ab59cd8
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0-rc001"
        },
        {
            "fixed": "10.8.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
38712dce16aa9412af3d81d4884bfc6e5533e019
Fixed
5dfa76600a9bd673888ff7f2a6ac5c87297cb981
Database specific 
{
    "versions": [
        {
            "introduced": "11.0.0-rc1"
        },
        {
            "fixed": "12.3.4"
        }
    ]
}

Affected versions

release-10.*

release-10.0.0
release-10.0.0-rc1
release-10.0.0-rc2
release-10.0.0-rc3
release-10.0.0-rc4
release-10.0.0-rc5
release-10.0.1
release-10.1.0
release-10.1.0-rc
release-10.1.0-rc2
release-10.2.0
release-10.2.0-rc
release-10.2.1
release-10.3.0
release-10.3.0-rc
release-10.3.1
release-10.3.2
release-10.4.0-rc1
release-10.4.1
release-10.5.0
release-10.5.0-rc
release-10.6.0
release-10.6.0-rc
release-10.6.1
release-10.7.0
release-10.7.0-rc
release-10.8.0
release-10.8.0-rc
release-10.8.1

release-11.*

release-11.0.0-rc1

release-8.*

release-8.14.1
release-8.14.2
release-8.14.3
release-8.14.4
release-8.15.0
release-8.15.1
release-8.15.2
release-8.15.3
release-8.16.0
release-8.16.0-rc
release-8.17.0
release-8.17.0-rc
release-8.17.0-rc2
release-8.17.1
release-8.17.2
release-8.18.0-rc

release-9.*

release-9.0.0
release-9.0.0-rc001
release-9.0.0-rc002
release-9.0.0-rc003
release-9.0.0-rc004
release-9.0.1
release-9.1.0
release-9.1.0-rc
release-9.1.1
release-9.1.2
release-9.2.0
release-9.2.0-rc
release-9.3.0
release-9.3.0-rc
release-9.3.1
release-9.4.0
release-9.4.0-rc
release-9.4.1
release-9.4.2
release-9.5.0
release-9.5.0-rc
release-9.5.0-rc2
release-9.5.0-rc3
release-9.5.1