CVE-2024-29035: Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
Impact Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. Affected Versions Umbraco versions 13.0.0 - 13.1.1
Patches 13.1.1
Workarounds Disabling webhooks functionality.
Other sources
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29035?
CVE-2024-29035 is categorized as a medium severity vulnerability due to the exposure of sensitive webhook logs.
How do I fix CVE-2024-29035?
To fix CVE-2024-29035, update Umbraco to version 13.1.1 or later.
What versions of Umbraco are affected by CVE-2024-29035?
CVE-2024-29035 affects Umbraco versions 13.0.0 through 13.1.1.
Is there a workaround for CVE-2024-29035?
A workaround for CVE-2024-29035 is to disable the webhooks functionality in your Umbraco installation.
What information is exposed in the logs due to CVE-2024-29035?
The logs exposed by CVE-2024-29035 may contain critical information that could compromise security.