VYPR
← All advisories
High severity8.2NVD Advisory· Published Mar 3, 2017· Updated May 13, 2026

CVE-2015-8813

CVE-2015-8813

Description

The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Umbraco.CMSNuGet
< 7.4.07.4.0

Patches

1
924a016ffe7a

Fixes U4-7457 Server side request forgery (xsrf) in feedproxy.aspx

https://github.com/umbraco/Umbraco-CMSShannonNov 25, 2015via ghsa
commit
1 file changed · +3 −1
  • src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs+3 −1 modified
    @@ -27,7 +27,9 @@ protected void Page_Load(object sender, EventArgs e)
                         if (Uri.TryCreate(url, UriKind.Absolute, out requestUri))

                         {

                             var feedProxyXml = xmlHelper.OpenAsXmlDocument(IOHelper.MapPath(SystemFiles.FeedProxyConfig));

-                            if (feedProxyXml != null && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)

+                            if (feedProxyXml != null 

+                                && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null

+                                && requestUri.Port == 80)

                             {

                                 using (var client = new WebClient())

                                 {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.