PT-2023-22233 · Progress · Sitefinity

Published 2023-04-10 · Updated 2025-02-11 · CVE-2023-29376

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Progress Sitefinity versions 13.3 through 13.3.7646 Progress Sitefinity versions 14.0 through 14.0.7735 Progress Sitefinity versions 14.1 through 14.1.7825 Progress Sitefinity versions 14.2 through 14.2.7929 Progress Sitefinity versions 14.3 through 14.3.8024

Description There is potential for cross-site scripting (XSS) by privileged users in Sitefinity to media libraries. This issue allows attackers to potentially inject malicious scripts into the website.

Recommendations For Progress Sitefinity version 13.3, update to version 13.3.7647 or later. For Progress Sitefinity version 14.0, update to version 14.0.7736 or later. For Progress Sitefinity version 14.1, update to version 14.1.7826 or later. For Progress Sitefinity version 14.2, update to version 14.2.7930 or later. For Progress Sitefinity version 14.3, update to version 14.3.8025 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29376

Affected Products

Sitefinity

References · 7

• https://osv.dev/vulnerability/CVE-2023-29376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29376 · Security Note
• https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-April-2023 · Vendor Advisory
• https://t.me/cvenotify/110846 · Telegram Post
• https://t.me/cvenotify/47885 · Telegram Post
• https://progress.com/sitefinity-cms · Note
• https://t.me/cibsecurity/61760 · Telegram Post