VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Oct 12, 2017· Updated May 13, 2026

CVE-2017-15279

CVE-2017-15279

Description

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
UmbracoCMS.WebNuGet
< 7.7.37.7.3

Affected products

1

Patches

1
fe2b86b68145

Html encode nodenames to prevent XSS attacks. Fixes U4-10497 XSS Vulnerability in page name.

https://github.com/umbraco/Umbraco-CMSSebastiaan JanssenOct 6, 2017via ghsa
commit
2 files changed · +2 −2
  • src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs+1 −1 modified
    @@ -30,7 +30,7 @@ protected override void OnInit(EventArgs e)
             }

 

             DocumentId = doc.Id;

-            PageName = doc.Name;

+            PageName = Server.HtmlEncode(doc.Name);

             DocumentPath = doc.Path;

 

         }
  • src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs+1 −1 modified
    @@ -27,7 +27,7 @@ public notifications()
         protected void Page_Load(object sender, EventArgs e)

         {

             Button1.Text = ui.Text("update");

-            pane_form.Text = ui.Text("notifications", "editNotifications", node.Text, base.getUser());

+            pane_form.Text = ui.Text("notifications", "editNotifications", Server.HtmlEncode(node.Text), base.getUser());

         }

 

         #region Web Form Designer generated code

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.