CVE-2015-8813

Severity: high (CVSS 8.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-03-03 · updated 2026-06-17
Weakness: CWE-918

Description

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

Affected products

Umbraco: through 7.3.8

References

http://issues.umbraco.org/issue/U4-7457
http://www.openwall.com/lists/oss-security/2016/02/16/10
http://www.openwall.com/lists/oss-security/2016/02/17/1
http://www.openwall.com/lists/oss-security/2016/02/17/5
http://www.openwall.com/lists/oss-security/2016/02/18/8
https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce
http://issues.umbraco.org/issue/U4-7457
http://www.openwall.com/lists/oss-security/2016/02/16/10
http://www.openwall.com/lists/oss-security/2016/02/17/1
http://www.openwall.com/lists/oss-security/2016/02/17/5
http://www.openwall.com/lists/oss-security/2016/02/18/8
https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce

Get alerted when CVE-2015-8813 or the next vulnerability affects your stack