SSRF in Umbraco
CVE-2015-8813
The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.112 (95.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.112 · newest: 0.112 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- issues.umbraco.org/issue/U4-7457 (Issue Tracking)
- www.openwall.com/lists/oss-security/2016/02/17/1 (mailing-list, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2016/02/18/8 (mailing-list, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2016/02/17/5 (mailing-list, Exploit, Mailing List, Third Party Advisory)
- github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce (Patch, Vendor Advisory)
- www.openwall.com/lists/oss-security/2016/02/16/10 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2015-8813?
- CVE-2015-8813 is a high-severity vulnerability in Umbraco, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.2/10. Published 2017-03-03.
- How severe is CVE-2015-8813?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2015-8813 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.