Remote Code Execution Vulnerability in Sitecore CRM by Sitecore
CVE-2017-5965

6.7MEDIUM

Key Information:

Vendor

Sitecore

Status
Crm
Vendor
CVE Published:
23 May 2017

What is CVE-2017-5965?

The package manager in Sitecore CRM version 8.1 Rev 151207 contains a vulnerability that permits remote authenticated administrators to execute arbitrary ASP code. This is achieved by creating a ZIP archive that includes an .asp file with a parent directory reference in its pathname. By uploading this ZIP file through the Upload Package interface and subsequently accessing a specific URI, the .asp file can be executed on the server, leading to potential unauthorized actions.

References

http://research.aurainfosec.io/disclosures/2017-05-18-sit...
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.