GitHub Advisoryadvisory · NuGet

GHSA-x34j-wxq8-7vcm Umbraco CMS vulnerable to CSRF

HIGH Published 2022-05-17 Modified 2023-08-03 Official page ↗
Aliases
CVE-2015-8813
Ecosystem
NuGet
Packages
Umbraco.CMS
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Weaknesses
CWE-918
Reviewed
2023-08-03

Affected packages

• NuGet Umbraco.CMS: < 7.4.0 → fixed in 7.4.0

Description

The `Page_Load` function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

Related

Alias · CVE (1)

  • CVE-2015-8813 The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References