Every CVE Search/ Get API key

CVE-2024-34071

Open Redirect Bypass Protection

6.1 MediumFix available

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.38%Up 0.3 points since May 22, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.1

Open Redirect Bypass Protection

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

Record
CVE-2024-34071
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2024-1661 6.1

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

Record
EUVD-2024-1661
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j74q-mv2c-rxmp 6.1

Umbraco CMS Open Redirect Bypass Protection

Impact

Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed.

Affected Version

>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0

Patches

8.18.14, 10.8.6, 12.3.10, 13.3.1

Record
GHSA-j74q-mv2c-rxmp
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
NVD 6.1

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

Record
CVE-2024-34071
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSV 6.1

Open Redirect Bypass Protection

Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

Record
CVE-2024-34071
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVGHSA-j74q-mv2c-rxmp 6.1

Umbraco CMS Open Redirect Bypass Protection

Impact

Umbraco have an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice, before the vulnerability is exposed.

Affected Version

>= 8.18.5, >= 10.5.0, >= 12.0.0, >= 13.0.0

Patches

8.18.14, 10.8.6, 12.3.10, 13.3.1

Record
GHSA-j74q-mv2c-rxmp
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
UmbracoCms.Core
NuGet
 8.18.5 up to 8.18.14
8.18.14
UmbracoCms.Core
NuGet
 10.5.0 up to 10.8.6
10.8.6
UmbracoCms.Core
NuGet
 12.0.0 up to 12.3.10
12.3.10
UmbracoCms.Core
NuGet
 13.0.0 up to 13.3.1
13.3.1
Umbraco.Cms.Web.BackOffice
NuGet
 8.18.5 up to 8.18.14
8.18.14
Umbraco.Cms.Web.BackOffice
NuGet
 10.5.0 up to 10.8.6
10.8.6
Umbraco.Cms.Web.BackOffice
NuGet
 12.0.0 up to 12.3.10
12.3.10
Umbraco.Cms.Web.BackOffice
NuGet
 13.0.0 up to 13.3.1
13.3.1
UmbracoCms.Core
NuGet
 8.18.5 up to 8.18.14, plus listed versions
8.18.108.18.118.18.128.18.138.18.68.18.78.18.88.18.9
8.18.14
Umbraco.Cms.Web.BackOffice
NuGet
 10.5.0 up to 10.8.6, plus listed versions
10.5.110.6.010.6.0-rc10.6.110.7.0
Show 8 moreShow less
10.7.0-rc10.8.010.8.0-rc10.8.110.8.210.8.310.8.410.8.5
10.8.6
Umbraco.Cms.Web.BackOffice
NuGet
 12.0.0 up to 12.3.10, plus listed versions
12.0.112.1.012.1.0-rc12.1.112.1.2
Show 13 moreShow less
12.2.012.2.0-rc12.3.012.3.0-rc12.3.112.3.212.3.312.3.412.3.512.3.612.3.712.3.812.3.9
12.3.10
Umbraco.Cms.Web.BackOffice
NuGet
 13.0.0 up to 13.3.1, plus listed versions
13.0.113.0.213.0.313.1.013.1.0-rc
Show 7 moreShow less
13.1.113.2.013.2.0-rc13.2.113.2.213.3.013.3.0-rc
13.3.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34071 is a medium vulnerability (CVSS 6.1) in Umbraco Cms, published May 21, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in UmbracoCms.Core 8.18.14.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open