CVE-2022-22690 Umbraco Remote ApplicationURL Overwrite
Attackers can overwrite the application URL to intercept password reset tokens, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22690?
CVE-2022-22690 is a high-severity vulnerability in Umbraco Umbraco Cms, published on 18 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.
Weakness: CWE-444
Which versions are affected by CVE-2022-22690?
2 open source packages ship an affected version, including Umbraco.Cms.Core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Cms.Core NuGet | All versions | 9.2.0 |
Umbraco.Cms.Core NuGet | All versions | 9.2.0 |
Products include Umbraco Umbraco Cms.
How do I fix CVE-2022-22690?
Upgrade Umbraco.Cms.Core to 9.2.0 or later.
Is CVE-2022-22690 being exploited?
There is no known exploitation of CVE-2022-22690 in the wild and no public exploit code.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Sources
Also known as GHSA-jrmq-rv9w-63rv.