Summary
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Progress Software Sitefinity ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.
Product
Progress Sitefinity ist eine .NET Web Content Management Plattform.
Vulnerabilities 2
-
High 8.8
Incorrect access control in the Sitefinity backend
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
-
High 8.0
Potential Cross-Site Scripting (XSS) in the page editing area
Potential Cross-Site Scripting (XSS) in the page editing area.
Revision history
-
#1
Initiale Fassung
References
-
Sitefinity Security Advisory vom 2024-02-28
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024
-
GitHub Advisory Database vom 2024-02-28
https://github.com/advisories/GHSA-whfc-7h32-gf82
-
GitHub Advisory Database vom 2024-02-28
https://github.com/advisories/GHSA-2q6p-h6rg-vx7w