TI-2022-06952 Aliases CVE-2022-22691 GHSA-r8pr-83cc-ccv7

Umbraco Password Reset URL Poison

LOW 34CWE-640Published 2022-01-18 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.

Why it matters now

EPSS 0.01016 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Umbraco CMS (Umbraco): 9.2.0Umbraco.Cms.Core (NuGet): 9.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
umbraco	Umbraco CMS	before 9.2.0	9.2.0	Patch available	CNA
—	Umbraco.Cms.Core (NuGet)	before 9.2.0	9.2.0	Patch available	GHSA-r8pr-83cc-ccv7

Umbraco CMS Vendorumbraco Affected before 9.2.0 Fixed in 9.2.0 Patch available CNA
Umbraco.Cms.Core (NuGet) Vendor— Affected before 9.2.0 Fixed in 9.2.0 Patch available GHSA-r8pr-83cc-ccv7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:umbraco:umbraco_cms::::::::	before 9.2.0	Vulnerable	umbraco

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions before 9.2.0 Vulnerable ·umbraco

Remediation

Fix · CNA Umbraco CMS (Umbraco) Fixed in 9.2.0
Fix · GHSA-r8pr-83cc-ccv7 Umbraco.Cms.Core (NuGet) Fixed in 9.2.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-01-18
Umbraco CMS 9.2.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-06951 Umbraco Remote ApplicationURL OverwritePriority MEDIUM 40
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-22691
2026-10-03 Alias added: GHSA-r8pr-83cc-ccv7

References

Exploit 1

https://appcheck-ng.com/umbraco-applicationurl-overwrite-persistent-password-reset-poison-cve-2022-22690-cve-2022-22691/

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-22691

Other 2

TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences