Skip to content

18.2.2

Latest
Latest

Choose a tag to compare

View all tags
@AndyButland AndyButland released this 27 Oct 06:19
release-18.2.2
490b9b2
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

馃敀 Security

  • Resolved backoffice users can grant user groups start nodes outside their own access (start node restriction bypass) from GHSA-r4qv-c8pg-qq59
  • Resolved start-node restrictions not enforced on URL, imaging and reference lookups from GHSA-xqwv-jvcm-5vjq
  • Resolved stored XSS chained with path traversal in Umbraco CMS media management from GHSA-88p9-4pxf-pq3c
  • Resolved backoffice logout does not invalidate the auth cookie (session not ended server-side) from GHSA-4qmm-fhgv-vq9g
  • Resolved unpublished content exposed through website preview and the Delivery API from GHSA-24m3-86rh-6888
  • Resolved website preview session did not expire from GHSA-4vcm-wj6q-3pmg
  • Resolved backoffice account takeover via sign-in redirect manipulation in Umbraco CMS from GHSA-rpv9-qp4c-g469

Full Changelog: release-18.2.1...release-18.2.2

Assets 2
Loading