CVE-2019-7215
Estado: ModificadaMedia (6.5)—
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.04%
- Percentil entre todas las CVEs puntuadas: 63
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-613
Referencias
- https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D
- https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019
- https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D
- https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-7215",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-06-06T17:29:00.383",
"references": [
{
"url": "https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D",
"source": "cve@mitre.org"
},
{
"url": "https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-613"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed."
},
{
"lang": "es",
"value": "Progress Sitefinity 10.1.6536 no invalida las cookies de sesión al cerrar la sesión. En su lugar, intenta sobrescribir la cookie en el navegador, pero sigue siendo válida en el lado del servidor. Esto significa que la cookie se puede reutilizar para mantener el acceso a la cuenta, incluso si se cambian las credenciales y los permisos de la cuenta."
}
],
"lastModified": "2026-06-17T02:40:15.560",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "277BD71B-6CE3-435B-8BA8-3F1EBB02E76C",
"versionEndExcluding": "7.0.5143",
"versionStartIncluding": "7.0"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24A8ADA8-5742-4141-940A-B7ED1AF319F8",
"versionEndExcluding": "7.1.5243",
"versionStartIncluding": "7.1"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "422E03B1-714E-4F25-8CE9-48682C867DA1",
"versionEndExcluding": "7.2.5353",
"versionStartIncluding": "7.2"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8E20A20-7522-4DA7-AB34-0C6DC8FC74CA",
"versionEndExcluding": "7.3.5693",
"versionStartIncluding": "7.3"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4700637-9C9E-4F5A-9844-BF2F3303102A",
"versionEndExcluding": "8.0.5773",
"versionStartIncluding": "8.0"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D756D511-7699-4951-8456-DDF43B2592A4",
"versionEndExcluding": "8.1.5863",
"versionStartIncluding": "8.1"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "030764BB-4532-4AD0-AE89-8AD06C07AE0E",
"versionEndExcluding": "8.2.5973",
"versionStartIncluding": "8.2"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "594F2749-3088-46A7-BBE6-6A490722D059",
"versionEndExcluding": "9.0.6063",
"versionStartIncluding": "9.0"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A9A4720-84A1-4CF1-96F6-F7DDE3031599",
"versionEndExcluding": "9.1.6183",
"versionStartIncluding": "9.1"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D871475-D354-439A-BFD1-3238F68FC2AA",
"versionEndExcluding": "9.2.6274",
"versionStartIncluding": "9.2"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE8C4C3B-C0E5-44FE-AAA9-B0C0C930DB6A",
"versionEndExcluding": "10.0.6429",
"versionStartIncluding": "10.0"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCC9A73D-572F-41B1-9830-C069FBA63DA7",
"versionEndIncluding": "10.1.6540",
"versionStartIncluding": "10.1"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D640141-AD94-4FBE-9655-0DBEB5F7E485",
"versionEndExcluding": "10.2.6649",
"versionStartIncluding": "10.2"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E43A58F8-5134-43E0-81DA-F38956671F3B",
"versionEndExcluding": "11.0.6736",
"versionStartIncluding": "11.0"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DCABE1C-030E-4097-99BA-A7D40039C497",
"versionEndExcluding": "11.1.6826",
"versionStartIncluding": "11.1"
},
{
"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65D928E7-F706-4101-899F-DCA0BF1FC459",
"versionEndExcluding": "11.2.6929",
"versionStartIncluding": "11.2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}