TI-2017-11197 Aliases CVE-2017-15280 GHSA-h2vq-7gf2-qw9v

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to…

LOW 27CWE-611Published 2017-10-12 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Why it matters now

EPSS 0.0106 64th percentileScored 2026-11-07

Fix Fixed UmbracoCms.Web (NuGet): 7.7.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	UmbracoCms.Web (NuGet)	before 7.7.3	7.7.3	Patch available	GHSA-h2vq-7gf2-qw9v

— Vendor— Affected all versions Fixed in — No fix listed CNA
UmbracoCms.Web (NuGet) Vendor— Affected before 7.7.3 Fixed in 7.7.3 Patch available GHSA-h2vq-7gf2-qw9v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:umbraco:umbraco_cms::::::::	up to 7.7.2	Vulnerable	umbraco

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions up to 7.7.2 Vulnerable ·umbraco

Remediation

Fix · GHSA-h2vq-7gf2-qw9v UmbracoCms.Web (NuGet) Fixed in 7.7.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-15280
2026-10-03 Alias added: GHSA-h2vq-7gf2-qw9v

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2017-15280

Other 2

TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences