Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1oMnZxLTdnZjItcXc5ds4AAYVg

Umbraco CMS XXE Vulnerability

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Permalink: https://github.com/advisories/GHSA-h2vq-7gf2-qw9v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMnZxLTdnZjItcXc5ds4AAYVg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago


CVSS Score: 5.5
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00069
EPSS Percentile: 0.32526

Identifiers: GHSA-h2vq-7gf2-qw9v, CVE-2017-15280
References: Repository: https://github.com/umbraco/Umbraco-CMS
Blast Radius: 1.0

Affected Packages

nuget:UmbracoCms.Web
Dependent packages: 175
Dependent repositories: 0
Downloads: 2,687,331 total
Affected Version Ranges: < 7.7.3
Fixed in: 7.7.3
All affected versions:
All unaffected versions: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.3.0, 8.3.1, 8.4.0, 8.4.1, 8.4.2, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.6.0, 8.6.1, 8.6.2, 8.6.3, 8.6.4, 8.6.5, 8.6.6, 8.6.7, 8.6.8, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.8.0, 8.8.1, 8.8.2, 8.8.3, 8.8.4, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.10.0, 8.10.1, 8.10.2, 8.10.3, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.13.0, 8.13.1, 8.14.0, 8.14.1, 8.14.2, 8.14.3, 8.14.4, 8.15.0, 8.15.1, 8.15.2, 8.15.3, 8.16.0, 8.17.0, 8.17.1, 8.17.2, 8.18.0, 8.18.1, 8.18.2, 8.18.3, 8.18.4, 8.18.5, 8.18.6, 8.18.7, 8.18.8, 8.18.9, 8.18.10, 8.18.11, 8.18.12, 8.18.13, 8.18.14, 8.18.15