How severe is CVE-2024-48929?

CVE-2024-48929 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-48929 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-48929?

CVE-2024-48929 affects Umbraco Umbraco Cms. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-48929?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-48929 have an EU (EUVD) identifier?

Yes. CVE-2024-48929 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3159.

When was CVE-2024-48929 published?

CVE-2024-48929 was published on 2024-10-22 and last updated on 2026-06-17.

CVE-2024-48929

CVE-2024-48929 is a medium-severity vulnerability in Umbraco Umbraco Cms with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-384.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-3159
Weakness: CWE-384
Affected product: Umbraco Umbraco Cms
Published: 2024-10-22
Last modified: 2026-06-17

Description

Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.

Frequently asked questions

What is CVE-2024-48929?: Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
How severe is CVE-2024-48929?: CVE-2024-48929 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-48929 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-48929?: CVE-2024-48929 affects Umbraco Umbraco Cms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-48929?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-48929 have an EU (EUVD) identifier?: Yes. CVE-2024-48929 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3159.
When was CVE-2024-48929 published?: CVE-2024-48929 was published on 2024-10-22 and last updated on 2026-06-17.

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wxw9-6pv9-c3xc

Affected products (1)

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

More vulnerabilities in Umbraco Umbraco Cms

CVE-2025-67288 — Critical (CVSS 10.0): An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a…
CVE-2012-10054 — Critical (CVSS 9.8): Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx…
CVE-2014-10074 — Critical (CVSS 9.8): Umbraco before 7.2.0 has a remote PHP code execution vulnerability because…
CVE-2012-1301 — Critical (CVSS 9.8): The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url"…
CVE-2025-32017 — High (CVSS 8.8): Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are…
CVE-2020-9471 — High (CVSS 8.8): Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install…

All CVEs affecting Umbraco Umbraco Cms →

Other CWE-384 (Session Fixation) vulnerabilities

CVE-2024-11317 — Critical (CVSS 10.0): Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an…
CVE-2024-38513 — Critical (CVSS 10.0): Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a…
CVE-2021-20151 — Critical (CVSS 10.0): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's…
CVE-2025-67446 — Critical (CVSS 9.8): Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router…
CVE-2026-25101 — Critical (CVSS 9.8): Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same…
CVE-2026-24352 — Critical (CVSS 9.8): PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the…

Browse all CWE-384 (Session Fixation) vulnerabilities →