CyberSec.Space Logo
Back to CVE Browser

CVE-2019-17392

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0280%
EPSS Percentile39.11th
PublishedNov 26, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.

Affected Platforms (CPE)

📦
Progress

Sitefinity

>= 9.1 and < 9.1.6185
📦
Progress

Sitefinity

>= 9.2 and < 9.2.6276
📦
Progress

Sitefinity

>= 10.0 and < 10.0.6431
📦
Progress

Sitefinity

>= 10.1 and < 10.1.6542
📦
Progress

Sitefinity

>= 10.2 and <= 10.2.6651
📦
Progress

Sitefinity

>= 11.0 and <= 11.0.6739
📦
Progress

Sitefinity

>= 11.1 and <= 11.1.6828
📦
Progress

Sitefinity

>= 11.2 and <= 11.2.6934
📦
Progress

Sitefinity

>= 12.0 and <= 12.0.7032
📦
Progress

Sitefinity

>= 12.1 and <= 12.1.7128

References & Advisories

🔗 https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019
🔗 https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019

Related Vulnerabilities

CVE-2017-92489.8

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly ...

CVE-2017-158839.8

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause...

CVE-2017-181798.8

Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change o...

CVE-2018-170557.5

An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.