CVE-2024-11626

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-11626
Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025 Vendor Advisory
https://www.progress.com/sitefinity-cms Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*
cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*
cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*
cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*
History

29 Jul 2025, 19:34

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web del backend de CMS (sección administrativa) (XSS o 'Cross-site Scripting') en Progress Sitefinity. Este problema afecta a Sitefinity: desde la versión 4.0 hasta la 14.4.8142, desde la versión 15.0.8200 hasta la 15.0.8229, desde la versión 15.1.8300 hasta la 15.1.8327, desde la versión 15.2.8400 hasta la 15.2.8421.
References () https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025 - () https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025 - Vendor Advisory
References () https://www.progress.com/sitefinity-cms - () https://www.progress.com/sitefinity-cms - Product
First Time Progress sitefinity
Progress
CPE cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*

07 Jan 2025, 09:15

Type Values Removed Values Added
Summary (en) Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, 15.2.8400. (en) Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
References
  • () https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025 -

07 Jan 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-07 08:15

Updated : 2025-07-29 19:34

NVD link : CVE-2024-11626

Mitre link : CVE-2024-11626

CVE.ORG link : CVE-2024-11626

JSON object : View

Products Affected

progress

  • sitefinity
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')