Umbraco CMS vulnerable to CSRF

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-7210 · ADVISORY
• umbraco/Umbraco-CMS · PACKAGE
• sec-consult.com/en/blog/advisories/cross-site-request-forgery-csrf-in-umbraco-cms · WEB
• seclists.org/bugtraq/2020/Jan/35 · WEB
• packetstormsecurity.com/files/156062/Umbraco-CMS-8.2.2-Cross-Site-Request-Forgery.html · WEB
• seclists.org/fulldisclosure/2020/Jan/33 · WEB
• sec-consult.com/en/blog/advisories/cross-site-request-forgery-csrf-in-umbraco-cms · Exploit
• sec-consult.com/en/vulnerability-lab/advisories/index.html · Third Party Advisory

UmbracoCMS.Core のその他の脆弱性

• CVE-2020-9471高 8.8Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.