CVE-2022-22690 json
Umbraco Remote ApplicationURL Overwrite
published 2022-01-18 4 y ago modified 2026-06-17 4 mo ago also GHSA-jrmq-rv9w-63rv , EUVD-2022-0635
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.
Patch / fix
- nuget Umbraco.Cms.Core 9.2.0
- Umbraco Umbraco CMS 9.2.0
Exploit prediction
1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- appcheck-ng.com https://appcheck-ng.com/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.Core | <9.2.0 |
9.2.0 |
Affected products
- Umbraco Umbraco CMS
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
appcheck-ng.com
/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/
exploit, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-22690
advisory
-
appcheck-ng.com
/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691
web
-
github.com
/umbraco/Umbraco-CMS
package
Sources
- CVE List CVE-2022-22690
- GitHub Advisory GHSA-jrmq-rv9w-63rv
- NVD CVE-2022-22690
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.