CVE-2015-8813

This flaw can let an attacker “borrow” your server to request data from other places on the internet or your internal network. Think of it like giving a caller a remote control for your building’s intercom: instead of contacting you directly, they can make your building call other rooms/systems. That can expose internal systems or disrupt normal operations, depending on what your server can reach.

This matters if you run Umbraco CMS (the web platform used to build and manage your site) and your installation is on a version earlier than 7.4.0. It becomes a practical risk when the vulnerable FeedProxy functionality is reachable by an attacker (for example, via the site over the internet).

This is an SSRF issue that can be abused to make your server request other systems, including internal ones, so it’s worth acting on. While there’s no CISA KEV listing here, the vendor fix exists and the risk is tied to whether your affected version is exposed, so prioritize upgrading to 7.4.0.

1. Confirm exposure

   • Identify the exact product and version of your Umbraco CMS installation.
   • If your site is public-facing, treat the potentially vulnerable page path as reachable unless your deployment is strictly locked down.

2. Confirm whether you are vulnerable

   • You are considered vulnerable if you are running Umbraco CMS before 7.4.0.

3. Upgrade to the fixed version

   • Upgrade Umbraco CMS to 7.4.0 (fixed version).
   • Use the vendor’s recommended NuGet/package upgrade to ensure the code change for FeedProxy is included.
   • After upgrading, test the dashboard/admin areas that include FeedProxy to ensure normal operation.

4. If you cannot upgrade immediately (temporary containment)

   • Reduce exposure of the Umbraco dashboard endpoints (for example, restrict access to the relevant path(s) to trusted IPs or require a stronger access control layer in front of the site).
   • Review firewall/WAF rules to limit public access to internal/admin-style endpoints.

5. What to monitor

   • Check web server logs for unusual requests that look like FeedProxy access with unexpected url targets.
   • Monitor outbound connections from the application server for unexpected destinations triggered around the time of requests.

6. Follow-up

   • Once upgraded, re-run functional checks and confirm the site is on the fixed release line (7.4.0 or later).

Severity is high (SSRF can be used to target internal network resources and potentially access sensitive metadata/services depending on network reachability). The underlying weakness is CWE-918 (Server-Side Request Forgery). The attack vector is a crafted request that supplies a malicious value to the url parameter handled in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs; during Page_Load, the server performs outbound fetching based on that parameter. No CISA KEV entry was found for this CVE, so confirmed exploitation isn’t evidenced by KEV in the provided findings. A patch is available: Umbraco CMS is fixed in 7.4.0 (see vendor commit referenced in the findings). EPSS is reported as predicted likelihood (falling trend), but because the priority here is fixing a known SSRF bug with a concrete vendor patch, you should focus on upgrading. KEV is not listed for this CVE in the provided findings.