Umbraco · Umbraco · CVE-2024-28868
**Name of the Vulnerable Software and Affected Versions**
Umbraco 10 versions prior to 10.8.4
Umbraco 10 version 10.8.5 is not affected as it contains the fix.
**Description**
Umbraco is an ASP.NET content management system. A user enumeration attack is possible when access to the native login screen is available. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
**Recommendations**
For Umbraco 10 versions prior to 10.8.4, update to version 10.8.5 to resolve the issue.
As a temporary workaround, consider disabling the native login screen by exclusively using external logins until a patch is applied.