Unscored severity · published Dec 21, 2009
CVE-2009-4367
The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and…
–
CVSS
6.1%
EPSS
No
On KEV
Description
The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Staging Module · Sitecore
through 5.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4367
osvdb.org
http://osvdb.org/61147
Vendor Advisory
http://secunia.com/advisories/37763
Exploit
http://www.exploit-db.com/exploits/10513
www.securityfocus.com
http://www.securityfocus.com/archive/1/508529/100/0/threaded
Exploit
http://www.securityfocus.com/bid/37388
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/54881