UpHeron
All vulnerabilities

Servers and applications

CVE-2022-22691

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to…

Severity
High 7.4
Published
18 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.2.0
Sources
NVD

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • Every version before 9.2.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-22691
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-22691