Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-7215

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

Published

2019-06-06T17:29:00.383

Last Modified

2024-11-21T04:47:45.963

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-613
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application progress sitefinity < 7.0.5143 Yes
Application progress sitefinity < 7.1.5243 Yes
Application progress sitefinity < 7.2.5353 Yes
Application progress sitefinity < 7.3.5693 Yes
Application progress sitefinity < 8.0.5773 Yes
Application progress sitefinity < 8.1.5863 Yes
Application progress sitefinity < 8.2.5973 Yes
Application progress sitefinity < 9.0.6063 Yes
Application progress sitefinity < 9.1.6183 Yes
Application progress sitefinity < 9.2.6274 Yes
Application progress sitefinity < 10.0.6429 Yes
Application progress sitefinity ≤ 10.1.6540 Yes
Application progress sitefinity < 10.2.6649 Yes
Application progress sitefinity < 11.0.6736 Yes
Application progress sitefinity < 11.1.6826 Yes
Application progress sitefinity < 11.2.6929 Yes
References