umbraco/umbraco-cms · Security
Blind SSRF Leads to Port Scan by using Webhooks
- GHSA ID
- GHSA-74p6-39f2-23v3
- CVE ID
- CVE-2024-29035
- Severity
- medium
- Published
- Updated
- CVSS
- 4.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- CVSS v3
- 4.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Description
Impact
Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical.
Affected Versions
Umbraco versions 13.0.0 - 13.1.1
Patches
13.1.1
Workarounds
Disabling webhooks functionality.
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)