{"id":"CVE-2017-15280","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-15280","generatedAt":"2026-10-28T20:48:12.602Z","title":"XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to…","description":"XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.","published":"2017-10-12T08:29:01.000Z","lastModified":"2026-06-17T01:07:31.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-611"],"affected":["umbraco/umbraco cms"],"epss":{"score":0.0106,"percentile":0.6437,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.06%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://issues.umbraco.org/issue/U4-10506","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://issues.umbraco.org/issue/U4-10506","tags":["Issue Tracking","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-15280","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}