漏洞描述
Umbraco before version 7.4.0 contains a server-side request forgery vulnerability in feedproxy.aspx that allows attackers to send arbitrary HTTP GET requests via http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
blog.securelayer7.nethttps://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2015-8813↗github.comhttps://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2016/02/18/8↗issues.umbraco.orghttp://issues.umbraco.org/issue/U4-7457↗