PT-2017-13965 · Umbraco · Umbraco Cms

Nul800Sebastiaan · Publicado 2017-10-12 · Atualizado 2022-05-17 · CVE-2017-15280

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 7.7.3

Description The issue allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts, also known as Server-Side Request Forgery (SSRF). This is related to the file Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Recommendations For Umbraco CMS versions prior to 7.7.3, update to version 7.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the importDocumenttype.aspx.cs file to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-15280

GHSA-H2VQ-7GF2-QW9V

Produtos afetados

Umbraco Cms

Referências · 7

• https://github.com/umbraco/Umbraco-CMS · Nota
• https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64 · Correção
• https://github.com/umbraco/Umbraco-CMS/blob/release-7.7.3/src/Umbraco.Web/Umbraco.Web.csproj · Nota
• https://osv.dev/vulnerability/GHSA-h2vq-7gf2-qw9v · Aviso do Fabricante
• http://issues.umbraco.org/issue/U4-10506 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-15280 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15280 · Nota de Segurança