{"id":"CVE-2023-49273","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-49273","generatedAt":"2026-10-28T07:25:29.455Z","title":"Umbraco is an ASP.NET content management system (CMS).","description":"Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.","published":"2023-12-12T19:15:08.000Z","lastModified":"2026-06-17T06:35:44.000Z","status":"Modified","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-863"],"affected":["umbraco/umbraco cms"],"epss":{"score":0.00369,"percentile":0.3061,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8","tags":["Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-49273","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}