CVEブラウザに戻る

CVE-2018-17055

HIGH

7.5

CVSS Severity Score

EPSS Score0.1100%

EPSS Percentile16.26th

Published2018年9月28日

Last Modified2024年11月21日

Vulnerability Description

An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.

Affected Platforms (CPE)

📦

Progress

Sitefinity

>= 4.0 and <= 11.0

References & Advisories

🔗 https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/

🔗 https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018

🔗 https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/

🔗 https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018

関連する脆弱性情報

CVE-2019-173929.8

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandle...

CVE-2017-92489.8

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly ...

CVE-2017-158839.8

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause...

CVE-2017-181798.8

Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change o...