CVE-2020-29454: Incorrect permission enforcement in UmbracoCms
Summary
CVE-2020-29454: Incorrect permission enforcement in UmbracoCms. Affects UmbracoCms versions < 8.10.0. Fixed in 8.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UmbracoCms is an open-source content management system (CMS) built on the .NET platform. It provides a flexible and extensible framework for creating and managing websites. Umbraco allows users to create, edit, and publish content, as well as manage various settings and configurations. However, a vulnerability has been identified in UmbracoCms versions up to 8.9.1 that could lead to incorrect permission enforcement.
Vulnerability Detail
The vulnerability, identified as CVE-2020-29454, resides in the Editors/LogViewerController.cs file of Umbraco. It allows a user to access the logviewer endpoint even if they lack Applications.Settings access. This means that an unauthorized user could potentially view sensitive log files and gain insights into the system's activity. While the impact of this vulnerability is moderate, it still poses a risk to the confidentiality of the system's logs.
How To Fix
Minimum fixed version
8.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the logviewer endpoint by modifying the application's configuration or implementing custom access controls. This can be achieved by modifying the routing configuration or adding additional authorization checks in the LogViewerController. However, it is strongly advised to apply the official fix by upgrading to the latest version of UmbracoCms.
Conclusion
In conclusion, UmbracoCms versions up to 8.9.1 are affected by an incorrect permission enforcement vulnerability in the LogViewerController. This vulnerability allows unauthorized users to access the logviewer endpoint and view sensitive log files. To mitigate this issue, it is recommended to upgrade to UmbracoCms version 8.10.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for UmbracoCms →
FAQ
UmbracoCms is an open-source content management system (CMS) built on the .NET platform. It provides a flexible and extensible framework for creating and managing websites.
The vulnerability allows unauthorized users to access the logviewer endpoint and view sensitive log files, potentially compromising the confidentiality of system logs.
To fix this vulnerability, it is recommended to upgrade UmbracoCms to version 8.10.0 or later, which includes a fix for the incorrect permission enforcement issue.
As a temporary workaround, users can restrict access to the logviewer endpoint by modifying the application's configuration or implementing custom access controls.
For more information about UmbracoCms vulnerabilities, you can visit the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for UmbracoCms.
