exploitDog

CVE-2026-7313

Опубликовано: 02 июн. 2026

Источник: nvd

CVSS3: 8.7

CVSS3: 4.9

EPSS Низкий

Описание

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

Ссылки

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*

Версия от 8.0.5700 (включая) до 13.3.7652 (исключая)

EPSS

Процентиль: 24%

0.00319

Низкий

8.7 High

CVSS3

4.9 Medium

CVSS3

Дефекты

CWE-522

Связанные уязвимости

GHSA-28j7-fpg4-34hj

CVSS3: 8.7

github

2 месяца назад

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

EPSS

Процентиль: 24%

0.00319

Низкий

8.7 High

CVSS3

4.9 Medium

CVSS3

Дефекты

CWE-522