Access Control Bypass Affecting umbraco.cms.core package, versions [,9.2.0)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-UMBRACOCMSCORE-2359041
- published 23 Jan 2022
- disclosed 21 Jan 2022
- credit Unknown
Introduced: 21 Jan 2022
CVE-2022-22690 Open this link in a new tabHow to fix?
Upgrade Umbraco.Cms.Core to version 9.2.0 or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass via a configuration element named UmbracoApplicationUrl which is used whenever the application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site.
If the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the UmbracoApplicationUrl is used.
For instance, the attacker is able to change the URL users receive when resetting their password so that it points to the attacker's server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.