Umbraco CMS vulnerable to CSRF

HIGH 8.2CVE-2015-8813 · GHSA-x34j-wxq8-7vcm · Published 03/03/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
Umbraco.CMS NuGet	`< 7.4.0`	`7.4.0`
umbraco umbraco	`≤ 7.3.8`	No fix yet

Description

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

NVD description

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

References

nvd.nist.gov/vuln/detail/CVE-2015-8813 · ADVISORY
umbraco/Umbraco-CMS commit 924a016 · WEB
web.archive.org/web/20230608160721/https://issues.umbraco.org/issue/U4-7457 · WEB
openwall.com/lists/oss-security/2016/02/16/10 · WEB
openwall.com/lists/oss-security/2016/02/17/1 · WEB
openwall.com/lists/oss-security/2016/02/17/5 · WEB
openwall.com/lists/oss-security/2016/02/18/8 · WEB
issues.umbraco.org/issue/U4-7457 · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free