Lucene search

[email protected]CVE-2019-7215

HistoryJun 06, 2019 - 5:29 p.m.

CVE-2019-7215

2019-06-0617:29:00

CWE-613

[email protected]

web.nvd.nist.gov

123

cve-2019-7215

progress sitefinity

session cookies

logouts

account security

access control

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

Affected configurations

NVD

Node

progresssitefinityRange7.0–7.0.5143

progresssitefinityRange7.1–7.1.5243

progresssitefinityRange7.2–7.2.5353

progresssitefinityRange7.3–7.3.5693

progresssitefinityRange8.0–8.0.5773

progresssitefinityRange8.1–8.1.5863

progresssitefinityRange8.2–8.2.5973

progresssitefinityRange9.0–9.0.6063

progresssitefinityRange9.1–9.1.6183

progresssitefinityRange9.2–9.2.6274

progresssitefinityRange10.0–10.0.6429

progresssitefinityRange10.1–10.1.6540

progresssitefinityRange10.2–10.2.6649

progresssitefinityRange11.0–11.0.6736

progresssitefinityRange11.1–11.1.6826

progresssitefinityRange11.2–11.2.6929

CPENameOperatorVersion
progress:sitefinityprogress sitefinitylt7.0.5143
progress:sitefinityprogress sitefinitylt7.1.5243
progress:sitefinityprogress sitefinitylt7.2.5353
progress:sitefinityprogress sitefinitylt7.3.5693
progress:sitefinityprogress sitefinitylt8.0.5773
progress:sitefinityprogress sitefinitylt8.1.5863
progress:sitefinityprogress sitefinitylt8.2.5973
progress:sitefinityprogress sitefinitylt9.0.6063
progress:sitefinityprogress sitefinitylt9.1.6183
progress:sitefinityprogress sitefinitylt9.2.6274

CPE	Name	Operator	Version
progress:sitefinity	progress sitefinity	lt	7.0.5143
progress:sitefinity	progress sitefinity	lt	7.1.5243
progress:sitefinity	progress sitefinity	lt	7.2.5353
progress:sitefinity	progress sitefinity	lt	7.3.5693
progress:sitefinity	progress sitefinity	lt	8.0.5773
progress:sitefinity	progress sitefinity	lt	8.1.5863
progress:sitefinity	progress sitefinity	lt	8.2.5973
progress:sitefinity	progress sitefinity	lt	9.0.6063
progress:sitefinity	progress sitefinity	lt	9.1.6183
progress:sitefinity	progress sitefinity	lt	9.2.6274

Rows per page:

1-10 of 161

References

knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D

knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

Related for CVE-2019-7215

prion1 cvelist1 nvd1