CVE-2022-22691 json
Umbraco Password Reset URL Poison
published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-r8pr-83cc-ccv7 , EUVD-2022-0686
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.
Patch / fix
- nuget Umbraco.Cms.Core 9.2.0
- Umbraco Umbraco CMS 9.2.0
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- appcheck-ng.com https://appcheck-ng.com/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.Core | <9.2.0 |
9.2.0 |
Affected products
- Umbraco Umbraco CMS
Classification
References
-
appcheck-ng.com
/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/
exploit, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-22691
advisory
-
appcheck-ng.com
/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691
web
-
github.com
/umbraco/Umbraco-CMS
package
Sources
- CVE List CVE-2022-22691
- GitHub Advisory GHSA-r8pr-83cc-ccv7
- NVD CVE-2022-22691
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.