CVE-2024-48929
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
- Record
CVE-2024-48929- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2024-3159
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
- Record
EUVD-2024-3159- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wxw9-6pv9-c3xc
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Impact
During an explicit sign-out, the server session is not fully terminated.
- Record
GHSA-wxw9-6pv9-c3xc- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
- Record
CVE-2024-48929- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
- Record
CVE-2024-48929- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-wxw9-6pv9-c3xc
Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
Impact
During an explicit sign-out, the server session is not fully terminated.
- Record
GHSA-wxw9-6pv9-c3xc- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.CMSNuGet |
13.0.0 up to 13.5.2 | 13.5.2 |
Umbraco.CMSNuGet |
10.0.0 up to 10.8.7 | 10.8.7 |
Umbraco.CMSNuGet |
13.0.0 up to 13.5.2, plus listed versions 13.0.113.0.213.0.313.1.013.1.0-rc Show 16 moreShow less13.1.113.2.013.2.0-rc13.2.113.2.213.3.013.3.0-rc13.3.113.3.213.4.013.4.0-rc13.4.0-rc213.4.113.5.013.5.0-rc13.5.1 |
13.5.2 |
Umbraco.CMSNuGet |
10.0.0 up to 10.8.7, plus listed versions 10.0.110.1.010.1.0-rc10.1.0-rc210.1.1 Show 27 moreShow less10.2.010.2.0-rc10.2.110.3.010.3.0-rc10.3.110.3.210.4.010.4.0-rc10.4.110.4.210.5.010.5.0-rc10.5.110.6.010.6.0-rc10.6.110.7.010.7.0-rc10.8.010.8.0-rc10.8.110.8.210.8.310.8.410.8.510.8.6 |
10.8.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-48929 is a medium vulnerability (CVSS 4.2) in Umbraco Cms, published October 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in Umbraco.CMS 13.5.2.