CVE-2015-8813

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

• CWE-918

• http://issues.umbraco.org/issue/U4-7457Issue Tracking
• http://www.openwall.com/lists/oss-security/2016/02/16/10Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/17/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/17/5Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/18/8Mailing List, Third Party Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbcePatch, Vendor Advisory
• http://issues.umbraco.org/issue/U4-7457Issue Tracking
• http://www.openwall.com/lists/oss-security/2016/02/16/10Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/17/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/17/5Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/18/8Mailing List, Third Party Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbcePatch, Vendor Advisory

Published

Mar 3, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8804x86_64/ecc-384-modp.asm in Nettle before 3.2 does not proper…
• CVE-2015-8805The ecc_256_modq function in ecc-256.c in Nettle before 3.2 …
• CVE-2015-8806dict.c in libxml2 allows remote attackers to cause a denial …7.5
• CVE-2015-8807Cross-site scripting (XSS) vulnerability in the _renderVarIn…
• CVE-2015-8808The DecodeImage function in coders/gif.c in GraphicsMagick 1…
• CVE-2015-8812drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel be…9.8
• CVE-2015-8814Umbraco before 7.4.0 allows remote attackers to bypass anti-…
• CVE-2015-8815Multiple cross-site scripting (XSS) vulnerabilities in Umbra…
• CVE-2015-8816The hub_activate function in drivers/usb/core/hub.c in the L…6.8
• CVE-2015-8817QEMU (aka Quick Emulator) built to use 'address_space_transl…
• CVE-2015-8818The cpu_physical_memory_write_rom_internal function in exec.…5.5
• CVE-2015-8819Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…