{"id":"CVE-2024-48929","aliases":["EUVD-2024-3159","GHSA-wxw9-6pv9-c3xc"],"status":"published","title":"Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out","description":"Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00269,"percentile":0.19131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384"],"published":"2024-10-22T15:54:23Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"NuGet","package":"Umbraco.CMS","fixed_in":["13.5.2","10.8.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.5.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.8.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.5.2"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.0.3","13.1.0","13.1.0-rc","13.1.1","13.2.0","13.2.0-rc","13.2.1","13.2.2","13.3.0","13.3.0-rc","13.3.1","13.3.2","13.4.0","13.4.0-rc","13.4.0-rc2","13.4.1","13.5.0","13.5.0-rc","13.5.1"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.8.7"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.1.0-rc","10.1.0-rc2","10.1.1","10.2.0","10.2.0-rc","10.2.1","10.3.0","10.3.0-rc","10.3.1","10.3.2","10.4.0","10.4.0-rc","10.4.1","10.4.2","10.5.0","10.5.0-rc","10.5.1","10.6.0","10.6.0-rc","10.6.1","10.7.0","10.7.0-rc","10.8.0","10.8.0-rc","10.8.1","10.8.2","10.8.3","10.8.4","10.8.5","10.8.6"]}],"products":[{"vendor":"umbraco","product":"umbraco-cms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wxw9-6pv9-c3xc","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48929","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wxw9-6pv9-c3xc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48929.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-48929","title":"Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out","description":"Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.","status":"published","published":"2024-10-22T15:54:23.813Z","modified":"2024-10-22T17:13:46.49Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-3159","description":"Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.","status":"published","published":"2024-10-22T15:54:23Z","modified":"2024-10-22T17:13:46Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:22.720016Z"}],"ghsa":[{"id":"GHSA-wxw9-6pv9-c3xc","title":"Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out","description":"### Impact\nDuring an explicit sign-out, the server session is not fully terminated.\n","status":"published","published":"2024-10-22T18:13:47Z","modified":"2024-10-22T19:22:32Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2024-48929","description":"Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.","status":"published","published":"2024-10-22T16:15:08.617Z","modified":"2026-06-17T07:59:04.33Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:10:33.928543Z"}],"osv":[{"id":"CVE-2024-48929","title":"Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out","description":"Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.","status":"published","published":"2024-10-22T15:54:23.813Z","modified":"2026-10-28T02:30:34.465034483Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"GHSA-wxw9-6pv9-c3xc","title":"Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out","description":"### Impact\nDuring an explicit sign-out, the server session is not fully terminated.\n","status":"published","published":"2024-10-22T18:13:47Z","modified":"2024-10-22T19:33:04.026882Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}