CVE-2021-47776CWE-918ssrf

CVE-2021-47776

Medium · published January 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-15T21:16Z
Affected products (1)
ProductVersionsFixed in
umbraco/umbraco_cmsall versions—
References (3)
https://our.umbraco.com/ · [email protected]https://releases.umbraco.com/all-releases · [email protected]https://www.exploit-db.com/exploits/50462 · [email protected]
EPSS history
Timeline
  • 15 JAN 15:52Z
    Umbraco v8.14.1 - 'baseUrl' SSRF
    cvelistv5