HIGH8.2

GHSA-x34j-wxq8-7vcm

Umbraco CMS vulnerable to CSRF

Quick fix

GHSA-x34j-wxq8-7vcm — Umbraco.CMS: upgrade to the fixed version with the command below.

dotnet add package Umbraco.CMS --version 7.4.0

Details

The `Page_Load` function in [Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs](https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce#diff-2899f01df84571577834f97a81637c65e20178ec6129b76c02f99789b23cf72e) in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/Umbraco.CMS

Introduced in: 0Fixed in: 7.4.0

Fixdotnet add package Umbraco.CMS --version 7.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2015-8813[ADVISORY]
https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce[WEB]
https://web.archive.org/web/20230608160721/https://issues.umbraco.org/issue/U4-7457[WEB]
http://www.openwall.com/lists/oss-security/2016/02/16/10[WEB]
http://www.openwall.com/lists/oss-security/2016/02/17/1[WEB]
http://www.openwall.com/lists/oss-security/2016/02/17/5[WEB]
http://www.openwall.com/lists/oss-security/2016/02/18/8[WEB]