Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-15280

CVE-2017-15280:
Umbraco CMS XXE Vulnerability

5.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-15280
GHSA ID
GHSA-h2vq-7gf2-qw9v
EPSS Score
0.41646%
CWE
CWE-611
Published
5/17/2022
Updated
10/23/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
UmbracoCms.Webnuget< 7.7.37.7.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from XML parsing in document type import functionality. The patch adds 'xd.XmlResolver = null' to both methods, indicating they previously used the default XmlResolver which processes external entities. These event handlers load XML from user-controlled files without proper restrictions, making them entry points for XXE attacks. The direct correlation between the vulnerability description and the patched code confirms these functions' role.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

XML *xt*rn*l *ntity (XX*) vuln*r**ility in Um*r**o *MS ***or* *.*.* *llows *tt**k*rs to o*t*in s*nsitiv* in*orm*tion *y r***in* *il*s on t** s*rv*r or s*n*in* T*P r*qu*sts to intr*n*t *osts (*k* SSR*), r*l*t** to `Um*r**o.W**/um*r**o.pr*s*nt*tion/um*

Reasoning

T** vuln*r**ility st*ms *rom XML p*rsin* in *o*um*nt typ* import *un*tion*lity. T** p*t** ***s 'x*.XmlR*solv*r = null' to *ot* m*t*o*s, in*i**tin* t**y pr*viously us** t** ****ult XmlR*solv*r w*i** pro**ss*s *xt*rn*l *ntiti*s. T**s* *v*nt **n*l*rs lo