CVE-2017-15280: XEE
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
Other sources
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15280?
CVE-2017-15280 has a medium severity level due to its potential for sensitive information exposure.
How do I fix CVE-2017-15280?
To fix CVE-2017-15280, upgrade Umbraco CMS to version 7.7.3 or later.
What is the nature of the vulnerability in CVE-2017-15280?
CVE-2017-15280 is an XML external entity (XXE) vulnerability allowing attackers to access sensitive files or conduct server-side request forgery (SSRF).
Which versions of Umbraco CMS are affected by CVE-2017-15280?
CVE-2017-15280 affects Umbraco CMS versions prior to 7.7.3.
Can CVE-2017-15280 lead to data breaches?
Yes, CVE-2017-15280 can lead to data breaches by allowing unauthorized access to sensitive information on the server.