issues.umbraco.orgConfirmation
http://issues.umbraco.org/issue/U4-7457 CVE-2015-8813
HIGHNuclei
Umbraco CMS vulnerable to CSRF
Record summary
CVE-2015-8813 has a selected CVSS score of 8.2 (high); EIP currently links 1 Nuclei template.
Description
The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Sep 19, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
umbracoBrowse umbraco / umbraco | VulnCheck | Version data not supplied | |
Umbraco.CMSBrowse NuGet / Umbraco.CMS | GitHub Advisory | Before 7.4.0 · Fixed in 7.4.0 | affected |
Nuclei templates
1ProjectDiscoveryHIGHUmbraco <7.4.0- Server-Side Request ForgeryCVSS 8.2
Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index.
Impact
The vulnerability can result in unauthorized access to sensitive information or systems, leading to potential data breaches or further exploitation.
Remediation
Upgrade Umbraco to version 7.4.0 or above to mitigate the vulnerability and apply any necessary patches or security updates.
WeaknessesCWE-918
Authorsemadshanab
Template tagscve2015cvessrfoastumbracovkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CPE: cpe:2.3:a:umbraco:umbraco:*:*:*:*:*:*:*:*
https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/ https://nvd.nist.gov/vuln/detail/CVE-2015-8813 https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce http://www.openwall.com/lists/oss-security/2016/02/18/8 http://issues.umbraco.org/issue/U4-7457
Source: ProjectDiscovery
References
8[oss-security] 20160216 Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilitiesmailing list
http://www.openwall.com/lists/oss-security/2016/02/16/10 [oss-security] 20160217 Re: Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilitiesmailing list
http://www.openwall.com/lists/oss-security/2016/02/17/1 [oss-security] 20160217 Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilitiesmailing list
http://www.openwall.com/lists/oss-security/2016/02/17/5 [oss-security] 20160217 Re: Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilitiesmailing list
http://www.openwall.com/lists/oss-security/2016/02/18/8 github.comConfirmation
https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2015-8813 web.archive.org
https://web.archive.org/web/20230608160721/https://issues.umbraco.org/issue/U4-7457