Path Traversal Vulnerability in Sitecore CMS 8.2
CVE-2017-11440

4.9MEDIUM

Key Information:

Vendor

Sitecore

Status
Cms
Vendor
CVE Published:
19 July 2017

What is CVE-2017-11440?

In Sitecore CMS 8.2, an attacker can exploit a path traversal vulnerability through the 'fi' parameter in the shell/Applications/Layouts/IDE.aspx and the 'Reference' parameter in admin/LinqScratchPad.aspx. This flaw can be leveraged to access unauthorized files on the server, potentially exposing sensitive information.

References

https://xc0re.net/2017/07/03/sitecore-cms-v-8-2-multiple-...
x_refsource_MISC
https://packetstormsecurity.com/files/143357/Sitecore-CMS...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.