Auth bypass in Umbraco Cms
CVE-2013-4793
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.
Vulnerability class: Broken Authentication
EPSS: 0.014 (70.1th percentile) — read the EPSS interpretation.
Affected products
- Umbraco Umbraco_cms
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC)