Lucene search

[email protected]CVE-2023-6784

HistoryDec 20, 2023 - 2:15 p.m.

CVE-2023-6784

2023-12-2014:15:22

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-6784

nvd

sitefinity

phishing

distribution

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.6%

JSON

A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.

Affected configurations

NVD

Node

progresssitefinityRange4.0–13.3.7648

progresssitefinityRange14.1–14.1.7828

progresssitefinityRange14.2–14.2.7932

progresssitefinityRange14.3–14.3.8029

progresssitefinityRange14.4–14.4.8133

progresssitefinityRange15.0–15.0.8223

CPENameOperatorVersion
progress:sitefinityprogress sitefinitylt13.3.7648
progress:sitefinityprogress sitefinitylt14.1.7828
progress:sitefinityprogress sitefinitylt14.2.7932
progress:sitefinityprogress sitefinitylt14.3.8029
progress:sitefinityprogress sitefinitylt14.4.8133
progress:sitefinityprogress sitefinitylt15.0.8223

CPE	Name	Operator	Version
progress:sitefinity	progress sitefinity	lt	13.3.7648
progress:sitefinity	progress sitefinity	lt	14.1.7828
progress:sitefinity	progress sitefinity	lt	14.2.7932
progress:sitefinity	progress sitefinity	lt	14.3.8029
progress:sitefinity	progress sitefinity	lt	14.4.8133
progress:sitefinity	progress sitefinity	lt	15.0.8223

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Sitefinity",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "15.0.8223",
        "status": "affected",
        "version": "15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "14.4.8133",
        "status": "affected",
        "version": "14.4",
        "versionType": "semver"
      },
      {
        "lessThan": "14.3.8029",
        "status": "affected",
        "version": "14.3",
        "versionType": "semver"
      },
      {
        "lessThan": "14.2.7932",
        "status": "affected",
        "version": "14.2",
        "versionType": "semver"
      },
      {
        "lessThan": "14.1.7828",
        "status": "affected",
        "version": "14.1",
        "versionType": "semver"
      },
      {
        "lessThan": "13.3.7648",
        "status": "affected",
        "version": "13.3",
        "versionType": "semver"
      }
    ]
  }
]

References

community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023

www.progress.com/sitefinity-cms

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.6%

JSON

Related for CVE-2023-6784

prion1 nvd1 cvelist1