Description
Umbraco CMS includes a ClientDependency package that is vulnerable to a local file inclusion (LFI) in the default installation. The ClientDependency package, used by Umbraco, exposes the "DependencyHandler.axd" file in the root of the website. This file is used to combine and minify CSS and JavaScript files, which are supplied in a base64 encoded string.
Remediation
The Umbraco team have released a fixed version of the ClientDependency package. For more information consult the Umbraco security advisory listed in web references.
References
Related Vulnerabilities
WordPress Plugin WP-Lytebox 'pg' Parameter Local File Inclusion (1.3)
WordPress Plugin LearnPress-WordPress LMS Local File Inclusion (4.2.6.8.2)
WordPress Plugin Loco Translate Local File Inclusion (2.2.1)
WordPress Plugin MasterStudy LMS-for Online Courses and Education Local File Inclusion (3.3.0)