Description
The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Umbraco <7.4.0- Server-Side Request Forgery http/cves/2015/CVE-2015-8813.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Umbraco.CMS | < 7.4.0 | 7.4.0 | GHSA-x34j-wxq8-7vcm |
References
- http://issues.umbraco.org/issue/U4-7457
- [oss-security] 20160217 Re: Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilities mailing-list
- [oss-security] 20160217 Re: Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilities mailing-list
- [oss-security] 20160217 Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilities mailing-list
- https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce
- [oss-security] 20160216 Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilities mailing-list