CVE-2017-11440

Опубликовано: 19 июл. 2017

Источник: nvd

CVSS3: 4.9

CVSS2: 4

EPSS Низкий

Описание

In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.

Ссылки

https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html
Exploit
Third Party Advisory
VDB Entry
https://xc0re.net/2017/07/03/sitecore-cms-v-8-2-multiple-vulnerabilties/
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html
Exploit
Third Party Advisory
VDB Entry
https://xc0re.net/2017/07/03/sitecore-cms-v-8-2-multiple-vulnerabilties/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sitecore:cms:8.2:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00869

Низкий

4.9 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-4vgr-mpfq-v32m