Lucene search

MitreCVE-2019-7215

HistoryJun 06, 2019 - 5:29 p.m.

CVE-2019-7215

2019-06-0617:29:00

CWE-613

mitre

web.nvd.nist.gov

127

cve-2019-7215

progress sitefinity

session cookies

logouts

account security

access control

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

Affected configurations

Nvd

Node

progresssitefinityRange7.0–7.0.5143

progresssitefinityRange7.1–7.1.5243

progresssitefinityRange7.2–7.2.5353

progresssitefinityRange7.3–7.3.5693

progresssitefinityRange8.0–8.0.5773

progresssitefinityRange8.1–8.1.5863

progresssitefinityRange8.2–8.2.5973

progresssitefinityRange9.0–9.0.6063

progresssitefinityRange9.1–9.1.6183

progresssitefinityRange9.2–9.2.6274

progresssitefinityRange10.0–10.0.6429

progresssitefinityRange10.1–10.1.6540

progresssitefinityRange10.2–10.2.6649

progresssitefinityRange11.0–11.0.6736

progresssitefinityRange11.1–11.1.6826

progresssitefinityRange11.2–11.2.6929

VendorProductVersionCPE
progresssitefinity*cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
progress	sitefinity	*	cpe:2.3:a:progress:sitefinity::::::::

References

knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D

knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Related for CVE-2019-7215