CVE Daily

CVE-2009-4367

The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore...

Medium CVSS 6.8

Overview

The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.

CWE: CWE-287 Published: 2009-12-21T16:30:00.593
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.8 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags