CVE-2024-43376

5.3 mediumEPSS 0.4%

Medium (5.3) in umbraco umbraco cms. EPSS 0.4% chance of exploitation in the next 30 days.

Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-209
Published: 2024-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

umbraco:umbraco_cms

References

https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-77gj-crhp-3gvx

Check your stack JSON