Lucene search

[email protected]CVE-2019-17392

HistoryNov 26, 2019 - 6:15 p.m.

CVE-2019-17392

2019-11-2618:15:15

CWE-640

[email protected]

web.nvd.nist.gov

cve-2019-17392

progress sitefinity

weak password recovery

http header

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.

Affected configurations

NVD

Node

progresssitefinityRange9.1–9.1.6185

progresssitefinityRange9.2–9.2.6276

progresssitefinityRange10.0–10.0.6431

progresssitefinityRange10.1–10.1.6542

progresssitefinityRange10.2–10.2.6651

progresssitefinityRange11.0–11.0.6739

progresssitefinityRange11.1–11.1.6828

progresssitefinityRange11.2–11.2.6934

progresssitefinityRange12.0–12.0.7032

progresssitefinityRange12.1–12.1.7128

CPENameOperatorVersion
progress:sitefinityprogress sitefinitylt9.1.6185
progress:sitefinityprogress sitefinitylt9.2.6276
progress:sitefinityprogress sitefinitylt10.0.6431
progress:sitefinityprogress sitefinitylt10.1.6542
progress:sitefinityprogress sitefinityle10.2.6651
progress:sitefinityprogress sitefinityle11.0.6739
progress:sitefinityprogress sitefinityle11.1.6828
progress:sitefinityprogress sitefinityle11.2.6934
progress:sitefinityprogress sitefinityle12.0.7032
progress:sitefinityprogress sitefinityle12.1.7128

CPE	Name	Operator	Version
progress:sitefinity	progress sitefinity	lt	9.1.6185
progress:sitefinity	progress sitefinity	lt	9.2.6276
progress:sitefinity	progress sitefinity	lt	10.0.6431
progress:sitefinity	progress sitefinity	lt	10.1.6542
progress:sitefinity	progress sitefinity	le	10.2.6651
progress:sitefinity	progress sitefinity	le	11.0.6739
progress:sitefinity	progress sitefinity	le	11.1.6828
progress:sitefinity	progress sitefinity	le	11.2.6934
progress:sitefinity	progress sitefinity	le	12.0.7032
progress:sitefinity	progress sitefinity	le	12.1.7128

References

knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

Related for CVE-2019-17392

prion1 nvd1 cvelist1