Umbraco CMS XXE Vulnerability
Date: 2022-05
Affected: nuget/UmbracoCms.Web
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2017-15280
CWE: CWE-611
CVSS: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to `Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs`.


Mitigations:

Architectural layers (MAESTRO):