GitHub Advisoryadvisory · NuGet
GHSA-74p6-39f2-23v3 Blind SSRF Leads to Port Scan by using Webhooks
MEDIUM
Official page ↗
- Aliases
- CVE-2024-29035
- Ecosystem
- NuGet
- Packages
- Umbraco.Cms.Core, Umbraco.Cms.Web.BackOffice
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- Weaknesses
- CWE-918
- Reviewed
- 2024-04-17
Affected packages
• NuGet Umbraco.Cms.Core: >= 13.0.0, < 13.1.1 → fixed in 13.1.1
• NuGet Umbraco.Cms.Web.BackOffice: >= 13.0.0, < 13.1.1 → fixed in 13.1.1
Description
Impact
Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical.
Affected Versions
Umbraco versions 13.0.0 - 13.1.1
Patches
13.1.1
Workarounds
Disabling webhooks functionality.
Related
Alias · CVE (1)
- CVE-2024-29035 Umbraco is an ASP.NET CMS. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness