« Volver al listado

CVE-2019-17392

Estado: ModificadaCrítica (9.8)—

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Progress — Sitefinity

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-17392",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-26T18:15:15.600",
  "references": [
    {
      "url": "https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled."
    },
    {
      "lang": "es",
      "value": "Progress Sitefinity versión 12.1, tiene un mecanismo de recuperación de contraseña débil para una contraseña olvidada porque el encabezado de Host de HTTP es manejado inapropiadamente."
    }
  ],
  "lastModified": "2026-06-17T02:23:52.500",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24DE62D6-B2DA-4FC0-8499-87BEC5B708FD",
              "versionEndExcluding": "9.1.6185",
              "versionStartIncluding": "9.1"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6F1B054-D1ED-4C4D-BD13-E45C9ADA6334",
              "versionEndExcluding": "9.2.6276",
              "versionStartIncluding": "9.2"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6394DFD0-9003-4EA1-924D-7998952B9ACE",
              "versionEndExcluding": "10.0.6431",
              "versionStartIncluding": "10.0"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3B0CD2B-5682-41F3-8BFF-8E9D8CE3B8C1",
              "versionEndExcluding": "10.1.6542",
              "versionStartIncluding": "10.1"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49939784-741E-45F2-B464-8E70657DE6AC",
              "versionEndIncluding": "10.2.6651",
              "versionStartIncluding": "10.2"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31EF4B77-881F-4D7C-A682-D33715529106",
              "versionEndIncluding": "11.0.6739",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B83FA0DE-D7C7-4ABB-B690-891C84C57F35",
              "versionEndIncluding": "11.1.6828",
              "versionStartIncluding": "11.1"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F120DE8-80E6-48F7-B7D0-AFE5EBFE2A76",
              "versionEndIncluding": "11.2.6934",
              "versionStartIncluding": "11.2"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28C12336-9006-4233-A073-20DE08E09F28",
              "versionEndIncluding": "12.0.7032",
              "versionStartIncluding": "12.0"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51135FAE-3AD9-484A-9181-705AFA658170",
              "versionEndIncluding": "12.1.7128",
              "versionStartIncluding": "12.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}