GHSA-74p6-39f2-23v3

Source

https://github.com/advisories/GHSA-74p6-39f2-23v3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-74p6-39f2-23v3/GHSA-74p6-39f2-23v3.json

Aliases

• CVE-2024-29035

Published

2024-04-17T18:20:28Z

Modified

2024-04-17T18:41:53.440069Z

Summary

Blind SSRF Leads to Port Scan by using Webhooks

Details

Impact

Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical.

Affected Versions

Umbraco versions 13.0.0 - 13.1.1

Patches

13.1.1

Workarounds

Disabling webhooks functionality.

References

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-74p6-39f2-23v3
• https://nvd.nist.gov/vuln/detail/CVE-2024-29035
• https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0
• https://github.com/umbraco/Umbraco-CMS