CVE-2017-15883

high-risk

Published 2018-01-08

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Sitefinity

Affected Vendors

Progress

References (4)

Vendor Advisory https://knowledgebase.progress.com/articles/Article/Sitefinity-Security-Advisory...

Third Party Advisory https://www.mnemonic.no/news/2017/vulnerability-finding-sitefinity-cms/

Vendor Advisory https://knowledgebase.progress.com/articles/Article/Sitefinity-Security-Advisory...

Third Party Advisory https://www.mnemonic.no/news/2017/vulnerability-finding-sitefinity-cms/

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 0/34 · Minimal

Exposure 20/34 · Moderate