CVE-2017-15280

Description

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.193

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-15279,CVE-2017-15280 are fixed in Nuget - UmbracoCMS.Web 7.7.3	Windows
Vulnerabilities CVE-2017-15279,CVE-2017-15280 are fixed in Nuget - UmbracoCMS.Web for Linux 7.7.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234