GitHub Advisoryadvisory · NuGet

GHSA-h2vq-7gf2-qw9v Umbraco CMS XXE Vulnerability

MEDIUM Published 2022-05-17 Modified 2023-10-23 Official page ↗
Aliases
CVE-2017-15280
Ecosystem
NuGet
Packages
UmbracoCms.Web
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2023-07-26

Affected packages

• NuGet UmbracoCms.Web: < 7.7.3 → fixed in 7.7.3

Description

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to `Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs`.

Related

Alias · CVE (1)

  • CVE-2017-15280 XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References