Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-z8zv-hnpq-gyhb

Summary

Improper Restriction of XML External Entity Reference
XML external entity (XXE) vulnerability in Umbraco CMS allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.

Aliases

alias	CVE-2017-15280

Fixed_packages

url	pkg:nuget/UmbracoCms@7.7.3
purl	pkg:nuget/UmbracoCms@7.7.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@7.7.3

Affected_packages

url pkg:nuget/UmbracoCms@7.7.2

purl pkg:nuget/UmbracoCms@7.7.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-uf32-4mb4-97fz

vulnerability	VCID-z8zv-hnpq-gyhb

resource_url http://public2.vulnerablecode.io/packages/pkg:nuget/UmbracoCms@7.7.2

References

reference_url	http://issues.umbraco.org/issue/U4-10506
reference_id
reference_type
scores
url	http://issues.umbraco.org/issue/U4-10506

reference_url	https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64
reference_id
reference_type
scores
url	https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-15280
reference_id	CVE-2017-15280
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-15280

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	611
name	Improper Restriction of XML External Entity Reference
description	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z8zv-hnpq-gyhb

Vulnerability Instance