CVE-2017-11440 In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
MediumCVSS 4.9
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sitecore cms | = 8.2 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- xc0re.net exploit third-party-advisory