CVE-2015-10142: Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-10142?
CVE-2015-10142 has a critical severity rating due to its potential for unauthorized file access.
How do I fix CVE-2015-10142?
To fix CVE-2015-10142, upgrade Sitecore Experience Platform to version 8.0 Initial Release or Sitecore Content Management System to version 7.2 Update-3 or 7.5 Update-1.
Which versions are affected by CVE-2015-10142?
CVE-2015-10142 affects Sitecore Experience Platform versions prior to 8.0 and Sitecore Content Management System versions prior to 7.2 Update-3 and 7.5 Update-1.
What type of vulnerability is CVE-2015-10142?
CVE-2015-10142 is a file download vulnerability that may allow attackers to access files beneath the web root.
Can CVE-2015-10142 be exploited remotely?
Yes, CVE-2015-10142 can potentially be exploited remotely, allowing attackers to download sensitive files.