CVE-2017-18175

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.70%

Published

Feb 12, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixed in 10.1.

Weaknesses (CWE)

CWE-79

Affected Products (1)

progress · sitefinityvulnerable

References (4)

https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html

ExploitThird Party AdvisoryVDB Entry

https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html

ExploitThird Party Advisory

https://packetstormsecurity.com/files/143894/Progress-Sitefinity-9.1-XSS-Session-Management-Open-Redirect.html

ExploitThird Party AdvisoryVDB Entry

https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-progress-sitefinity/index.html

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs