Umbraco vulnerabilities

Umbraco before version 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks, as demonstrated by editing user account information in the templates.asmx.cs file.

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.

Umbraco prior to 13.15.1, 17.5.3, and 18.0.2, in the Content Delivery API, applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values.

Umbraco, an ASP.NET CMS, in versions 10.0.0 through 13.12.0 unsafely handles and deletes temporary files during dictionary upload. An attacker with backoffice access can trigger predictable requests to temporary file paths, and error responses (HTTP 500 when a file exists, 404 when it does not) allow enumeration of arbitrary files on the server filesystem.