Medium severity · published Jun 6, 2019
CVE-2019-7215
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts
6.5
CVSS
1%
EPSS
No
On KEV
Description
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sitefinity · Progress
7.0 before 7.0.5143; 7.1 before 7.1.5243; 7.2 before 7.2.5353; 7.3 before 7.3.5693; 8.0 before 8.0.5773; 8.1 before 8.1.5863; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7215
knowledgebase.progress.com
https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D
Release Notes
https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019
More from Sitefinity
9.8
CVE-2017-9248
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
9.8
CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress Sitefinity
9.8
CVE-2023-29375
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025
9.8
CVE-2019-17392
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled
9.8
CVE-2017-15883
Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or…