CVE-2024-43376: 
C# vulnerability analysis and mitigation

Umbraco, an ASP.NET CMS, was found to have a security vulnerability (CVE-2024-43376) where certain endpoints in the Management API could expose stack trace information even when the system is not in debug mode. This vulnerability affects versions from 14.0.0 and was patched in version 14.1.2 (Vendor Advisory).

The vulnerability is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). The CVSS v3.1 base score is rated as 5.3 MEDIUM (NIST) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity. GitHub's assessment provides a slightly different CVSS score of 4.3 MEDIUM with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD, Vendor Advisory).

The vulnerability allows exposure of sensitive information through stack traces in error messages. This could potentially reveal internal system details and implementation specifics to attackers, which could be used to plan more targeted attacks (Vendor Advisory).

The vulnerability can be triggered when using certain Management API endpoints, for example, when paging with negative numbers in some APIs. The exploit requires network access and low privileges to execute (Vendor Advisory).

The vulnerability has been fixed in Umbraco version 14.1.2. Users are advised to upgrade to this version or later to address the security issue (Vendor Advisory, Patch).