Umbraco <7.4.0- Server-Side Request Forgery

Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index. id: CVE-2015-8813 info: name: Umbraco 7.4.0- Server-Side Request...

CVE-2015-8813

Umbraco CMS versions before 7.4.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the Page_Load function of Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs. Attackers can exploit the url parameter to conduct arbitrary HTTP GET requests, such as http://local...