CVE-2017-17762

EUVD-2017-8913
XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
episerverepiserver
𝑥
≤ 7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa
https://kryptera.se/sarbarhet-i-episerver/
https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa
https://kryptera.se/sarbarhet-i-episerver/