CVE-2026-46616

Опубликовано: 10 июн. 2026

Источник: nvd

CVSS3: 5.4

CVSS3: 6.1

EPSS Низкий

Описание

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

Ссылки

https://github.com/umbraco/Umbraco-CMS/pull/22561
Issue Tracking
Patch
https://github.com/umbraco/Umbraco-CMS/pull/22565
Issue Tracking
Patch
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Версия до 13.14.0 (исключая)

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

Версия от 14.0.0 (включая) до 17.4.0 (исключая)

EPSS

Процентиль: 8%

0.0018

Низкий

5.4 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

GHSA-2qjj-h6wp-c7h7

CVSS3: 5.4

github

3 месяца назад

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

EPSS

Процентиль: 8%

0.0018

Низкий

5.4 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-601