title: Potential Use of the Sitefinity System for Distribution of Phishing Emails
description:
A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: affected
product: Sitefinity
vendor: Progress Software Corporation
versions:
lessThan: 15.0.8223, status: affected, version: 15.0, versionType: semver
lessThan: 14.4.8133, status: affected, version: 14.4, versionType: semver
lessThan: 14.3.8029, status: affected, version: 14.3, versionType: semver
lessThan: 14.2.7932, status: affected, version: 14.2, versionType: semver
lessThan: 14.1.7828, status: affected, version: 14.1, versionType: semver
lessThan: 13.3.7648, status: affected, version: 13.3, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL