CVE-2022-22690— Umbraco 环境问题漏洞

Umbraco Remote ApplicationURL Overwrite

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

N/A

Umbraco 环境问题漏洞

Umbraco是丹麦Umbraco公司的一套C#编写的开源的内容管理系统（CMS）。 Umbraco CMS 存在环境问题漏洞，攻击者能够更改用户在重置密码时收到的 URL，使其指向攻击者服务器，当用户点击此链接时，重置令牌可以被攻击者拦截，从而导致帐户接管。

N/A

N/A