CVE-2017-15280 json
Umbraco CMS XXE Vulnerability
published 2017-10-12 9 y ago modified 2026-06-17 4 mo ago also GHSA-h2vq-7gf2-qw9v , EUVD-2022-4046
- cvss
- 5.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
Patch / fix
- nuget UmbracoCms.Web 7.7.3
Exploit prediction
1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | UmbracoCms.Web | <7.7.3 |
7.7.3 |
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64
web, patch, third-party-advisory
-
issues.umbraco.org
/issue/U4-10506
web, issue-tracking, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-15280
advisory
-
github.com
/umbraco/Umbraco-CMS
package
-
github.com
/umbraco/Umbraco-CMS/blob/release-7.7.3/src/Umbraco.Web/Umbraco.Web.csproj
web
Sources
- CVE List CVE-2017-15280
- GitHub Advisory GHSA-h2vq-7gf2-qw9v
- NVD CVE-2017-15280
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.