CVE-2017-15883: Weak Encryption

Published Jan 8, 2018

Updated

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography.

Affected Software

20 affected components

Progress Sitefinity=5.1

Progress Sitefinity=5.2

Progress Sitefinity=5.3

Progress Sitefinity=5.4

Progress Sitefinity=6.0

Progress Sitefinity=6.1

Progress Sitefinity=6.2

Progress Sitefinity=6.3

Progress Sitefinity=7.0

Progress Sitefinity=7.1

Progress Sitefinity=7.2

Progress Sitefinity=7.3

Progress Sitefinity=8.0

Progress Sitefinity=8.1

Progress Sitefinity=8.2

Progress Sitefinity=9.0

Progress Sitefinity=9.1

Progress Sitefinity=9.2

Progress Sitefinity=10.0

Progress Sitefinity=10.1

Event History

Jan 8, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is CVE-2017-15883?

CVE-2017-15883 is a cryptographic vulnerability in Sitefinity versions 5.1 to 10.1 that allows remote attackers to bypass authentication or gain privileges.

Which versions of Sitefinity are affected by CVE-2017-15883?

Sitefinity versions 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x are affected by CVE-2017-15883.

What is the severity of CVE-2017-15883?

CVE-2017-15883 has a severity score of 9.8 (Critical).

How can remote attackers exploit CVE-2017-15883?

Remote attackers can exploit CVE-2017-15883 to bypass authentication and cause a denial of service on load balanced sites or gain privileges.

Where can I find more information about CVE-2017-15883?

You can find more information about CVE-2017-15883 at the following references: [1], [2].