lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <200903172238.n2HMc5rS008726@www3.securityfocus.com> Date: Tue, 17 Mar 2009 16:38:05 -0600 From: security.assurance@....com.au To: bugtraq@...urityfocus.com Subject: Sitecore .NET 5.3.x - web service information disclosure Title: Sitecore web service information disclosure CVE Identifier: ____________ Credit: National Australia Bank's Security Assurance Team. The vendor was advised of this vulnerability prior to its public release. National Australia Bank adheres to the “Guidelines for Security Vulnerability Reporting and Response V2.0” document when issuing security advisories. Class: Information Disclosure Privilege Escalation Remote: Yes Local: Yes Vulnerable: Sitecore.NET 5.3.1 (rev. 071114) – other versions may also be vulnerable. Not Vulnerable: Vendor: Sitecore Discussion: National Australia Bank's Security Assurance Team have identified a vulnerability in the Visual Sitecore Service, part of the Sitecore CMS application, that allows low privileged users to gain access to administrative and other users’ credentials. Exploit: No exploit code provided. Simple SOAP/XML queries are all that is required. Solution: Apply patch V5.3.2 rev. 090212 References: Vendor Advisory http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx
Powered by blists - more mailing lists