{"id":"CVE-2015-8813","aliases":["EUVD-2022-5692","GHSA-x34j-wxq8-7vcm"],"status":"published","title":"Umbraco CMS vulnerable to CSRF","description":"The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.11154,"percentile":0.95972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2017-03-03T16:00:00Z","modified":"2026-06-17T00:35:18Z","exploits":[{"source":"nuclei","id":"CVE-2015-8813","title":"Umbraco \u003c7.4.0- Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8813.yaml"}],"fixes":[{"ecosystem":"NuGet","package":"Umbraco.CMS","fixed_in":["7.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.CMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0"}]}]}],"products":[{"vendor":"umbraco","product":"umbraco"}],"references":[{"url":"http://issues.umbraco.org/issue/U4-7457","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/17/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/18/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/17/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/16/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8813","tags":["advisory"]},{"url":"https://web.archive.org/web/20230608160721/https://issues.umbraco.org/issue/U4-7457","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x34j-wxq8-7vcm"}],"sources":{"cve":[{"id":"CVE-2015-8813","description":"The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","status":"published","published":"2017-03-03T16:00:00Z","modified":"2024-08-06T08:29:22.011Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2022-5692","description":"The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","status":"published","published":"2017-03-03T16:00:00Z","modified":"2024-08-06T08:29:22Z","updated_at":"2026-11-03T01:57:25.349664Z"}],"ghsa":[{"id":"GHSA-x34j-wxq8-7vcm","title":"Umbraco CMS vulnerable to CSRF","description":"The `Page_Load` function in [Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs](https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce#diff-2899f01df84571577834f97a81637c65e20178ec6129b76c02f99789b23cf72e) in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","status":"published","published":"2022-05-17T02:56:23Z","modified":"2023-08-12T05:02:27Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2015-8813","description":"The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","status":"published","published":"2017-03-03T16:59:00.153Z","modified":"2026-06-17T00:35:18.09Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-x34j-wxq8-7vcm","title":"Umbraco CMS vulnerable to CSRF","description":"The `Page_Load` function in [Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs](https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce#diff-2899f01df84571577834f97a81637c65e20178ec6129b76c02f99789b23cf72e) in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.","status":"published","published":"2022-05-17T02:56:23Z","modified":"2023-11-08T03:58:03.196383Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}