CVE-2017-15279 Umbraco CMS vulnerable to stored XSS

What is CVE-2017-15279?

CVE-2017-15279 is a medium-severity cross-site scripting vulnerability in Umbraco Umbraco Cms, published on 12 Oct 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.

Weakness: CWE-79

Which versions are affected by CVE-2017-15279?

2 open source packages ship an affected version, including UmbracoCMS.Web. It affects 1 product.

Products include Umbraco Umbraco Cms.

How do I fix CVE-2017-15279?

Upgrade UmbracoCMS.Web to 7.7.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-15279 being exploited?

There is no known exploitation of CVE-2017-15279 in the wild and no public exploit code.

Other vulnerabilities in Umbraco Umbraco Cms

• CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability Critical 10.0
• CVE-2014-10074 File upload in n/a Critical 9.8
• CVE-2012-1301 Server-side request forgery in n/a Critical 9.8
• CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE Critical 9.3
• CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users High 8.8

All Umbraco Umbraco Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xj94-rgf9-cq37.