CVE-2017-15280: XEE
First published: Thu Oct 12 2017(Updated: )
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to `Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs`.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| nuget/UmbracoCms.Web | <7.7.3 | 7.7.3 |
| Umbraco CMS | <=7.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://issues.umbraco.org/issue/U4-10506
- https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64
- https://nvd.nist.gov/vuln/detail/CVE-2017-15280
- https://github.com/umbraco/Umbraco-CMS/blob/release-7.7.3/src/Umbraco.Web/Umbraco.Web.csproj
- https://github.com/advisories/GHSA-h2vq-7gf2-qw9v (Advisory)
Frequently Asked Questions
What is the severity of CVE-2017-15280?
CVE-2017-15280 has a medium severity level due to its potential for sensitive information exposure.
How do I fix CVE-2017-15280?
To fix CVE-2017-15280, upgrade Umbraco CMS to version 7.7.3 or later.
What is the nature of the vulnerability in CVE-2017-15280?
CVE-2017-15280 is an XML external entity (XXE) vulnerability allowing attackers to access sensitive files or conduct server-side request forgery (SSRF).
Which versions of Umbraco CMS are affected by CVE-2017-15280?
CVE-2017-15280 affects Umbraco CMS versions prior to 7.7.3.
Can CVE-2017-15280 lead to data breaches?
Yes, CVE-2017-15280 can lead to data breaches by allowing unauthorized access to sensitive information on the server.
- collector/github-advisory-latest
- alias/GHSA-h2vq-7gf2-qw9v
- alias/CVE-2017-15280
- collector/github-advisory
- agent/weakness
- agent/author
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/nuget
- vendor/umbraco
- canonical/umbraco cms
- version/umbraco cms/7.7.2