Medium severity5.5NVD Advisory· Published Oct 12, 2017· Updated Jun 17, 2026
CVE-2017-15280
CVE-2017-15280
Description
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
UmbracoCms.WebNuGet | < 7.7.3 | 7.7.3 |
Affected products
2Patches
Vulnerability mechanics
References
5- issues.umbraco.org/issue/U4-10506nvdIssue TrackingPatchVendor AdvisoryWEB
- github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-h2vq-7gf2-qw9vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-15280ghsaADVISORY
- github.com/umbraco/Umbraco-CMS/blob/release-7.7.3/src/Umbraco.Web/Umbraco.Web.csprojghsaWEB
News mentions
0No linked articles in our index yet.