CVE-2015-8814

High

Published: 03/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Umbraco before version 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks, as demonstrated by editing user account information in the templates.asmx.cs file.

Risk Assessment

Attackers can exploit this vulnerability to unauthorized modification of user data, potentially leading to serious security breaches and loss of trust in the system.

Recommendation

It is recommended to upgrade Umbraco to version 7.4.0 or later to protect against these attacks.

Other vulnerabilities in Umbraco

CVE-2012-1301Critical
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.

Original NVD description (English source)

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.