PT-2026-3051 · Unknown · Umbraco Cms

Ngoanhduc · Published 2026-01-15 · Updated 2026-01-15 · CVE-2021-47776

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 8.14.1

Description The software contains a server-side request forgery issue that allows attackers to manipulate baseUrl parameters. This manipulation can occur in several controller endpoints, including the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints. Successful exploitation enables attackers to initiate unauthorized server-side requests to external hosts. The affected API endpoints are: '/umbraco/api/dashboard/help/page', '/umbraco/api/dashboard/content', and '/umbraco/api/dashboard/css'.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the GetContextHelpForPage(), GetRemoteDashboardContent(), and GetRemoteDashboardCss() functions.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-47776

GHSA-H66J-XM43-47PP

Affected Products

Umbraco Cms

References · 8

• 🔥 https://exploit-db.com/exploits/50462 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47776 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47776 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h66j-xm43-47pp · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/CVEnew/status/2011926094019248172 · Twitter Post
• https://releases.umbraco.com/all-releases · Note
• https://our.umbraco.com · Note