CVE-2023-49274: 
C# vulnerability analysis and mitigation

Umbraco, an ASP.NET content management system (CMS), was found to be vulnerable to a user enumeration attack starting from version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4. The vulnerability exists when SMTP is not set up correctly but reset password functionality is enabled (GitHub Advisory, NVD).

The vulnerability stems from the forgot password functionality displaying different error messages based on whether a user exists or not when SMTP is configured but not responding. This inconsistency in error messages enables user enumeration attacks. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 MEDIUM by NVD and 3.7 LOW by GitHub, with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows attackers to determine valid user accounts in the system through the password reset functionality. This information disclosure could potentially facilitate further attacks such as targeted phishing or brute force attempts (GitHub Advisory).

The vulnerability has been patched in Umbraco versions 8.18.10, 10.8.1, and 12.3.4. Users are advised to upgrade to these or later versions to address the security issue (NVD).