Information disclosure in Umbraco Identity Extensibility
CVE-2023-32312
UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (47.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Umbraco Identity Extensibility
- Umbraco Umbracoidentityextensions — versions <= 2.0.0
Weakness classification (CWE)
References
- github.com/umbraco/UmbracoIdentityExtensions/security/advisories/GHSA-f2rf-8mwf… (Patch, Vendor Advisory)
- github.com/umbraco/UmbracoIdentityExtensions/pull/53 (Patch)
- github.com/umbraco/UmbracoIdentityExtensions/commit/e792429f9d1fa25c1ba4f7a61d2… (Patch)
- docs.umbraco.com/umbraco-cms/reference/security/external-login-providers (Product)
Frequently asked questions
- What is CVE-2023-32312?
- CVE-2023-32312 is a low-severity vulnerability in Umbraco Identity Extensibility, classified under Information Disclosure. CVSS score: 3.7/10. Published 2023-06-09.
- How severe is CVE-2023-32312?
- Low severity. CVSS v3 base score is 3.7 out of 10.