PT-2017-12015 · Sitecore · Sitecore

Published 2017-07-19 · Updated 2017-07-21 · CVE-2017-11440

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sitecore version 8.2

Description The issue allows for absolute path traversal. This can be achieved through the fi parameter in the /shell/Applications/Layouts/IDE.aspx endpoint and the Reference parameter in the /admin/LinqScratchPad.aspx endpoint.

Recommendations For Sitecore version 8.2, as a temporary workaround, consider restricting access to the /shell/Applications/Layouts/IDE.aspx and /admin/LinqScratchPad.aspx endpoints until a patch is available. Avoid using the fi and Reference parameters in these endpoints to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-11440

Affected Products

Sitecore

References · 4

• 🔥 https://xc0re.net/2017/07/03/sitecore-cms-v-8-2-multiple-vulnerabilties · Exploit
• 🔥 https://packetstormsecurity.com/files/143357/Sitecore-CMS-8.2-Cross-Site-Scripting-File-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11440 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11440 · Vendor Advisory