CVE-2017-15280

5.5 mediumEPSS 1.1%

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Severity

CVSS 3.0

5.5 medium

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2017-10-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

umbraco:umbraco_cms

References

http://issues.umbraco.org/issue/U4-10506
https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64
http://issues.umbraco.org/issue/U4-10506
https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64

Check your stack JSON