CVE-2017-15280: Improper Restriction of XML External Entity Reference

May 17, 2022 (updated October 23, 2023)

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

References

issues.umbraco.org/issue/U4-10506
github.com/advisories/GHSA-h2vq-7gf2-qw9v
github.com/umbraco/Umbraco-CMS/blob/release-7.7.3/src/Umbraco.Web/Umbraco.Web.csproj
github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64
nvd.nist.gov/vuln/detail/CVE-2017-15280

Detect and mitigate CVE-2017-15280 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →