{"action":"Upgrade Umbraco.Cms.Infrastructure to 10.6.1 (10.x), 11.4.2 (11.x) or 12.0.1 (12.x) or later.","affected":[{"fixed":"10.6.1","introduced":"9.0.0"},{"fixed":"11.4.2","introduced":"11.0.0"},{"fixed":"12.0.1","introduced":"12.0.0"}],"component":"Umbraco.Cms.Infrastructure","cve_ids":["CVE-2023-37267"],"ecosystem":"NuGet","epss":0.00715,"exploited":false,"fixed_versions":["10.6.1","11.4.2","12.0.1"],"ghsa_id":"GHSA-h8wc-r4jh-mg7m","id":"tcs_01M5N8QN58GRDX4W0NK2XQPBC0","modified_at":"2024-02-16T07:58:25.940145Z","published_at":"2023-07-13T17:02:07Z","references":["https://osv.dev/vulnerability/GHSA-h8wc-r4jh-mg7m","https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7m","https://nvd.nist.gov/vuln/detail/CVE-2023-37267","https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410e","https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569","https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed","https://github.com/umbraco/Umbraco-CMS"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h8wc-r4jh-mg7m","url":"https://osv.dev/vulnerability/GHSA-h8wc-r4jh-mg7m"}],"summary":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions"}