CVE-2009-4367 The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2)....
MediumCVSS 6.8
EPSS 6.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sitecore staging module | <= 5.4.0 | No fix listed |
References
- 61147 vdb-entry
- 37763 third-party-advisory vendor-advisory
- 10513 exploit
- 20091217 SEC Consult SA-20091217-0 :: Authentication bypass and file manipulation in Sitecore Staging Module mailing-list
- 37388 exploit vdb-entry
- sitecore-staging-api-sec-bypass(54881) vdb-entry
- www.sec-consult.com exploit