Vulnerabilities > CVE-2017-15280 - XXE vulnerability in Umbraco CMS

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

umbraco

CWE-611

NVD

Published: 2017-10-12

Updated: 2024-11-21

Summary

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Vulnerable Configurations

Part	Description	Count
Application	Umbraco Umbraco Umbraco CMS 4.5.2 Umbraco Umbraco CMS 4.6.0 Umbraco Umbraco CMS 4.7.0 Umbraco Umbraco CMS 4.7.2 Umbraco Umbraco CMS 4.8.0 Umbraco Umbraco CMS 4.8.1 Umbraco Umbraco CMS 4.9.0 Umbraco Umbraco CMS 4.9.1 Umbraco Umbraco CMS 4.10.0 Umbraco Umbraco CMS 4.11.0 Umbraco Umbraco CMS 4.11.1 Umbraco Umbraco CMS 4.11.2 Umbraco Umbraco CMS 4.11.2.1 Umbraco Umbraco CMS 4.11.2.2 Umbraco Umbraco CMS 4.11.3 Umbraco Umbraco CMS 4.11.4 Umbraco Umbraco CMS 4.11.5 Umbraco Umbraco CMS 4.11.6 Umbraco Umbraco CMS 4.11.7 Umbraco Umbraco CMS 4.11.9 Umbraco Umbraco CMS 4.11.10 Umbraco Umbraco CMS 6.0.0 Umbraco Umbraco CMS 6.0.2 Umbraco Umbraco CMS 6.0.3 Umbraco Umbraco CMS 6.0.4 Umbraco Umbraco CMS 6.0.6 Umbraco Umbraco CMS 6.0.7 Umbraco Umbraco CMS 6.1.0 Umbraco Umbraco CMS 6.1.1 Umbraco Umbraco CMS 6.1.2 Umbraco Umbraco CMS 6.1.3 Umbraco Umbraco CMS 6.1.4 Umbraco Umbraco CMS 6.1.5 Umbraco Umbraco CMS 6.1.6 Umbraco Umbraco CMS 6.2.0 Umbraco Umbraco CMS 6.2.1 Umbraco Umbraco CMS 6.2.2 Umbraco Umbraco CMS 6.2.3 Umbraco Umbraco CMS 6.2.4 Umbraco Umbraco CMS 6.2.5 Umbraco Umbraco CMS 6.2.6 Umbraco Umbraco CMS 7.0.0 Umbraco Umbraco CMS 7.0.1 Umbraco Umbraco CMS 7.0.2 Umbraco Umbraco CMS 7.0.3 Umbraco Umbraco CMS 7.0.4 Umbraco Umbraco CMS 7.1.0 Umbraco Umbraco CMS 7.1.1 Umbraco Umbraco CMS 7.1.2 Umbraco Umbraco CMS 7.1.3 Umbraco Umbraco CMS 7.1.4 Umbraco Umbraco CMS 7.1.5 Umbraco Umbraco CMS 7.1.6 Umbraco Umbraco CMS 7.1.7 Umbraco Umbraco CMS 7.1.8 Umbraco Umbraco CMS 7.1.9 Umbraco Umbraco CMS 7.1.10 Umbraco Umbraco CMS 7.2.0 Umbraco Umbraco CMS 7.2.1 Umbraco Umbraco CMS 7.2.2 Umbraco Umbraco CMS 7.2.3 Umbraco Umbraco CMS 7.2.4 Umbraco Umbraco CMS 7.2.5 Umbraco Umbraco CMS 7.2.6 Umbraco Umbraco CMS 7.2.7 Umbraco Umbraco CMS 7.2.8 Umbraco Umbraco CMS 7.2.9 Umbraco Umbraco CMS 7.3.0 Umbraco Umbraco CMS 7.3.1 Umbraco Umbraco CMS 7.3.2 Umbraco Umbraco CMS 7.3.3 Umbraco Umbraco CMS 7.3.4 Umbraco Umbraco CMS 7.3.5 Umbraco Umbraco CMS 7.3.6 Umbraco Umbraco CMS 7.3.7 Umbraco Umbraco CMS 7.3.8 Umbraco Umbraco CMS 7.3.9 Umbraco Umbraco CMS 7.4.0 Umbraco Umbraco CMS 7.4.1 Umbraco Umbraco CMS 7.4.2 Umbraco Umbraco CMS 7.4.3 Umbraco Umbraco CMS 7.4.4 Umbraco Umbraco CMS 7.5.0 Umbraco Umbraco CMS 7.5.1 Umbraco Umbraco CMS 7.5.2 Umbraco Umbraco CMS 7.5.3 Umbraco Umbraco CMS 7.5.4 Umbraco Umbraco CMS 7.5.5 Umbraco Umbraco CMS 7.5.6 Umbraco Umbraco CMS 7.5.7 Umbraco Umbraco CMS 7.5.8 Umbraco Umbraco CMS 7.5.9 Umbraco Umbraco CMS 7.5.10 Umbraco Umbraco CMS 7.5.11 Umbraco Umbraco CMS 7.5.12 Umbraco Umbraco CMS 7.5.13 Umbraco Umbraco CMS 7.5.14 Umbraco Umbraco CMS 7.5.15 Umbraco Umbraco CMS 7.6.0 Umbraco Umbraco CMS 7.6.1 Umbraco Umbraco CMS 7.6.2 Umbraco Umbraco CMS 7.6.3 Umbraco Umbraco CMS 7.6.4 Umbraco Umbraco CMS 7.6.5 Umbraco Umbraco CMS 7.6.6 Umbraco Umbraco CMS 7.6.7 Umbraco Umbraco CMS 7.6.8 Umbraco Umbraco CMS 7.6.9 Umbraco Umbraco CMS 7.6.10 Umbraco Umbraco CMS 7.6.11 Umbraco Umbraco CMS 7.6.12 Umbraco Umbraco CMS 7.6.13 Umbraco Umbraco CMS 7.6.14 Umbraco Umbraco CMS 7.7.0 Umbraco Umbraco CMS 7.7.1 Umbraco Umbraco CMS 7.7.2	142

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References