CVE-2015-8813

HIGH EXPLOITED NUCLEI

Umbraco < 7.3.8 - SSRF

Title source: rule

Description

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

Nuclei Templates (1)

Umbraco <7.4.0- Server-Side Request Forgery

HIGHby emadshanab

References (6)

[Issue Tracking] http://issues.umbraco.org/issue/U4-7457

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/02/16/10

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/02/17/1

[Exploit, Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/02/17/5

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/02/18/8

[Patch, Vendor Advisory] https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce

Scores

CVSS v3 8.2

EPSS 0.8280

EPSS Percentile 99.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Details

VulnCheck KEV 2024-09-19

CWE

CWE-918

Status published

Products (2)

nuget/Umbraco.CMS 0 - 7.4.0NuGet

umbraco/umbraco < 7.3.8

Published Mar 03, 2017

Tracked Since Feb 18, 2026