Sitecore .NET 5.3.x - web service information disclosure

2009-03-18 / 2009-03-19
Risk: Low
Local: No
Remote: Yes


CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Title: Sitecore web service information disclosure CVE Identifier: ____________ Credit: National Australia Bank's Security Assurance Team. The vendor was advised of this vulnerability prior to its public release. National Australia Bank adheres to the "Guidelines for Security Vulnerability Reporting and Response V2.0" document when issuing security advisories. Class: Information Disclosure Privilege Escalation Remote: Yes Local: Yes Vulnerable: Sitecore.NET 5.3.1 (rev. 071114) other versions may also be vulnerable. Not Vulnerable: Vendor: Sitecore Discussion: National Australia Bank's Security Assurance Team have identified a vulnerability in the Visual Sitecore Service, part of the Sitecore CMS application, that allows low privileged users to gain access to administrative and other users credentials. Exploit: No exploit code provided. Simple SOAP/XML queries are all that is required. Solution: Apply patch V5.3.2 rev. 090212 References: Vendor Advisory http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx

References:

http://xforce.iss.net/xforce/xfdb/49298
http://www.vupen.com/english/advisories/2009/0753
http://www.securityfocus.com/bid/34162
http://www.securityfocus.com/archive/1/archive/1/501929/100/0/threaded
http://secunia.com/advisories/34356
http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top