Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1oMnZxLTdnZjItcXc5ds4AAYVg

Umbraco CMS XXE Vulnerability

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Permalink: https://github.com/advisories/GHSA-h2vq-7gf2-qw9v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMnZxLTdnZjItcXc5ds4AAYVg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 7 months ago


CVSS Score: 5.5
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Identifiers: GHSA-h2vq-7gf2-qw9v, CVE-2017-15280
References: Repository: https://github.com/umbraco/Umbraco-CMS
Blast Radius: 1.0

Affected Packages

nuget:UmbracoCms.Web
Dependent packages: 0
Dependent repositories: 0
Downloads: 2,414,508 total
Affected Version Ranges: < 7.7.3
Fixed in: 7.7.3
All affected versions:
All unaffected versions: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.3.0, 8.3.1, 8.4.0, 8.4.1, 8.4.2, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.8.0, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.10.0, 8.10.1, 8.10.2, 8.10.3, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.13.0, 8.13.1, 8.14.0, 8.14.1, 8.14.2, 8.14.3, 8.14.4, 8.15.0, 8.15.1, 8.15.2, 8.15.3, 8.16.0, 8.17.0, 8.17.1, 8.17.2, 8.18.0, 8.18.1, 8.18.2, 8.18.3, 8.18.4, 8.18.5, 8.18.6, 8.18.7, 8.18.8, 8.18.9, 8.18.10, 8.18.11, 8.18.12, 8.18.13