Lucene search

GitHub Advisory DatabaseGHSA-5F6P-4HXQ-RJXM

HistoryMay 17, 2022 - 2:56 a.m.

Umbraco CMS vulnerable to CSRF

2022-05-1702:56:23

CWE-352

GitHub Advisory Database

github.com

umbraco

csrf

vulnerability

security

templates

remote attacks

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.5%

JSON

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.

Affected configurations

Vulners

Node

umbraco.cmsRange<7.4.0

VendorProductVersionCPE
*umbraco.cms*cpe:2.3:a:*:umbraco.cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	umbraco.cms	*	cpe:2.3:a::umbraco.cms::::::::*

References

www.openwall.com/lists/oss-security/2016/02/16/10

github.com/advisories/GHSA-5f6p-4hxq-rjxm

github.com/umbraco/Umbraco-CMS/commit/18c3345e47663a358a042652e697b988d6a380eb

nvd.nist.gov/vuln/detail/CVE-2015-8814

web.archive.org/web/20230608152113/https://issues.umbraco.org/issue/U4-7459

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.5%

JSON

Related for GHSA-5F6P-4HXQ-RJXM