TI-2022-06951 Aliases CVE-2022-22690 GHSA-jrmq-rv9w-63rv

Umbraco Remote ApplicationURL Overwrite

MEDIUM 40CWE-444Published 2022-01-18 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.

Why it matters now

EPSS 0.01138 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Umbraco CMS (Umbraco): 9.2.0Umbraco.Cms.Core (NuGet): 9.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
umbraco	Umbraco CMS	before 9.2.0	9.2.0	Patch available	CNA
—	Umbraco.Cms.Core (NuGet)	before 9.2.0	9.2.0	Patch available	GHSA-jrmq-rv9w-63rv

Umbraco CMS Vendorumbraco Affected before 9.2.0 Fixed in 9.2.0 Patch available CNA
Umbraco.Cms.Core (NuGet) Vendor— Affected before 9.2.0 Fixed in 9.2.0 Patch available GHSA-jrmq-rv9w-63rv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:umbraco:umbraco_cms::::::::	before 9.2.0	Vulnerable	umbraco

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions before 9.2.0 Vulnerable ·umbraco

Remediation

Fix · CNA Umbraco CMS (Umbraco) Fixed in 9.2.0
Fix · GHSA-jrmq-rv9w-63rv Umbraco.Cms.Core (NuGet) Fixed in 9.2.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-01-18
Umbraco CMS 9.2.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-06952 Umbraco Password Reset URL PoisonPriority LOW 34
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-22690
2026-10-03 Alias added: GHSA-jrmq-rv9w-63rv

References

Exploit 1

https://appcheck-ng.com/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-22690

Other 2

TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences