Lucene search

ProgressSoftwareCVE-2023-6784

HistoryDec 20, 2023 - 2:15 p.m.

CVE-2023-6784

2023-12-2014:15:22

CWE-20

ProgressSoftware

web.nvd.nist.gov

cve-2023-6784

nvd

sitefinity

phishing

distribution

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.

Affected configurations

Nvd

Node

progresssitefinityRange4.0–13.3.7648

progresssitefinityRange14.1–14.1.7828

progresssitefinityRange14.2–14.2.7932

progresssitefinityRange14.3–14.3.8029

progresssitefinityRange14.4–14.4.8133

progresssitefinityRange15.0–15.0.8223

VendorProductVersionCPE
progresssitefinity*cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
progress	sitefinity	*	cpe:2.3:a:progress:sitefinity::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Sitefinity",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "15.0.8223",
        "status": "affected",
        "version": "15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "14.4.8133",
        "status": "affected",
        "version": "14.4",
        "versionType": "semver"
      },
      {
        "lessThan": "14.3.8029",
        "status": "affected",
        "version": "14.3",
        "versionType": "semver"
      },
      {
        "lessThan": "14.2.7932",
        "status": "affected",
        "version": "14.2",
        "versionType": "semver"
      },
      {
        "lessThan": "14.1.7828",
        "status": "affected",
        "version": "14.1",
        "versionType": "semver"
      },
      {
        "lessThan": "13.3.7648",
        "status": "affected",
        "version": "13.3",
        "versionType": "semver"
      }
    ]
  }
]

References

community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023

www.progress.com/sitefinity-cms

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

Related for CVE-2023-6784