Vulnerabilities > CVE-2017-15280 - XXE vulnerability in Umbraco CMS

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

umbraco

CWE-611

NVD

Published: 2017-10-12

Updated: 2017-10-25

Summary

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Vulnerable Configurations

Part	Description	Count
Application	Umbraco Umbraco Umbraco CMS 4.5.2 Umbraco Umbraco CMS 4.6.0 Umbraco Umbraco CMS 4.7.2 Umbraco Umbraco CMS 4.8.0 Umbraco Umbraco CMS 4.8.1 Umbraco Umbraco CMS 4.9.0 Umbraco Umbraco CMS 4.9.1 Umbraco Umbraco CMS 4.10.0 Umbraco Umbraco CMS 4.11.0 Umbraco Umbraco CMS 4.11.1 Umbraco Umbraco CMS 4.11.2 Umbraco Umbraco CMS 4.11.2.1 Umbraco Umbraco CMS 4.11.2.2 Umbraco Umbraco CMS 4.11.3 Umbraco Umbraco CMS 4.11.4 Umbraco Umbraco CMS 4.11.5 Umbraco Umbraco CMS 4.11.6 Umbraco Umbraco CMS 4.11.7 Umbraco Umbraco CMS 4.11.9 Umbraco Umbraco CMS 4.11.10 Umbraco Umbraco CMS 6.0.0 Umbraco Umbraco CMS 6.0.2 Umbraco Umbraco CMS 6.0.3 Umbraco Umbraco CMS 6.0.4 Umbraco Umbraco CMS 6.0.6 Umbraco Umbraco CMS 6.0.7 Umbraco Umbraco CMS 6.1.0 Umbraco Umbraco CMS 6.1.1 Umbraco Umbraco CMS 6.1.2 Umbraco Umbraco CMS 6.1.3 Umbraco Umbraco CMS 6.1.4 Umbraco Umbraco CMS 6.1.5 Umbraco Umbraco CMS 6.1.6 Umbraco Umbraco CMS 6.2.0 Umbraco Umbraco CMS 6.2.1 Umbraco Umbraco CMS 6.2.2 Umbraco Umbraco CMS 6.2.3 Umbraco Umbraco CMS 6.2.4 Umbraco Umbraco CMS 6.2.5 Umbraco Umbraco CMS 6.2.6 Umbraco Umbraco CMS 7.0.0 Umbraco Umbraco CMS 7.0.1 Umbraco Umbraco CMS 7.0.2 Umbraco Umbraco CMS 7.0.3 Umbraco Umbraco CMS 7.0.4 Umbraco Umbraco CMS 7.1.0 Umbraco Umbraco CMS 7.1.1 Umbraco Umbraco CMS 7.1.2 Umbraco Umbraco CMS 7.1.3 Umbraco Umbraco CMS 7.1.4 Umbraco Umbraco CMS 7.1.5 Umbraco Umbraco CMS 7.1.6 Umbraco Umbraco CMS 7.1.7 Umbraco Umbraco CMS 7.1.8 Umbraco Umbraco CMS 7.1.9 Umbraco Umbraco CMS 7.2.0 Umbraco Umbraco CMS 7.2.1 Umbraco Umbraco CMS 7.2.2 Umbraco Umbraco CMS 7.2.3 Umbraco Umbraco CMS 7.2.4 Umbraco Umbraco CMS 7.2.5 Umbraco Umbraco CMS 7.2.6 Umbraco Umbraco CMS 7.2.7 Umbraco Umbraco CMS 7.2.8 Umbraco Umbraco CMS 7.3.0 Umbraco Umbraco CMS 7.3.1 Umbraco Umbraco CMS 7.3.2 Umbraco Umbraco CMS 7.3.3 Umbraco Umbraco CMS 7.3.4 Umbraco Umbraco CMS 7.3.5 Umbraco Umbraco CMS 7.3.6 Umbraco Umbraco CMS 7.3.7 Umbraco Umbraco CMS 7.3.8 Umbraco Umbraco CMS 7.4.0 Umbraco Umbraco CMS 7.4.1 Umbraco Umbraco CMS 7.4.2 Umbraco Umbraco CMS 7.4.3 Umbraco Umbraco CMS 7.5.0 Umbraco Umbraco CMS 7.5.1 Umbraco Umbraco CMS 7.5.2 Umbraco Umbraco CMS 7.5.3 Umbraco Umbraco CMS 7.5.4 Umbraco Umbraco CMS 7.5.5 Umbraco Umbraco CMS 7.5.6 Umbraco Umbraco CMS 7.5.7 Umbraco Umbraco CMS 7.5.8 Umbraco Umbraco CMS 7.5.9 Umbraco Umbraco CMS 7.5.10 Umbraco Umbraco CMS 7.5.11 Umbraco Umbraco CMS 7.5.12 Umbraco Umbraco CMS 7.5.13 Umbraco Umbraco CMS 7.5.14 Umbraco Umbraco CMS 7.6.0 Umbraco Umbraco CMS 7.6.1 Umbraco Umbraco CMS 7.6.2 Umbraco Umbraco CMS 7.6.3 Umbraco Umbraco CMS 7.6.4 Umbraco Umbraco CMS 7.6.5 Umbraco Umbraco CMS 7.6.6 Umbraco Umbraco CMS 7.6.7 Umbraco Umbraco CMS 7.6.8 Umbraco Umbraco CMS 7.6.9 Umbraco Umbraco CMS 7.6.10 Umbraco Umbraco CMS 7.6.11 Umbraco Umbraco CMS 7.6.12 Umbraco Umbraco CMS 7.6.13 Umbraco Umbraco CMS 7.7.0 Umbraco Umbraco CMS 7.7.1 Umbraco Umbraco CMS 7.7.2	135

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References