CVE-2017-15280

2017-10-1208:29:00

Google

osv.dev

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.2%

JSON

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

CPENameOperatorVersion
umbraco-cmseqdev-7.6-beta04
umbraco-cmseqrelease-7.1.5
umbraco-cmseqrelease-7.6.1
umbraco-cmseqRelease-6.0.0-beta
umbraco-cmseqrelease-4.11.6
umbraco-cmseqdev-7.6-beta03
umbraco-cmseqrelease-4.11.10
umbraco-cmseqrelease-7.3.4
umbraco-cmseqrelease-7.6.0-RC
umbraco-cmseqrelease-7.6.0-beta

Name	Operator	Version
umbraco-cms	eq	dev-7.6-beta04
umbraco-cms	eq	release-7.1.5
umbraco-cms	eq	release-7.6.1
umbraco-cms	eq	Release-6.0.0-beta
umbraco-cms	eq	release-4.11.6
umbraco-cms	eq	dev-7.6-beta03
umbraco-cms	eq	release-4.11.10
umbraco-cms	eq	release-7.3.4
umbraco-cms	eq	release-7.6.0-RC
umbraco-cms	eq	release-7.6.0-beta