PT-2019-15125 · Progress · Sitefinity

Published 2019-11-26 · Updated 2019-12-14 · CVE-2019-17392

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Sitefinity version 12.1

Description The issue is related to a weak password recovery mechanism for forgotten passwords. This is due to the mishandling of the HTTP Host header, which can be exploited.

Recommendations For Progress Sitefinity version 12.1, consider restricting access to the password recovery mechanism until a proper fix is implemented. As a temporary workaround, avoid using the password recovery feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2019-17392

Affected Products

Sitefinity

References · 3

• https://osv.dev/vulnerability/CVE-2019-17392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17392 · Security Note
• https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019 · Vendor Advisory