Progress Sitefinity vulnerabilities

Progress Sitefinity in multiple versions (14.0.7700-14.4.8152, 15.0.8200-15.0.8234, 15.1.8300-15.1.8335, 15.2.8400-15.2.8441, 15.3.8500-15.3.8531, 15.4.8600-15.4.8630) has a vulnerability due to insufficiently protected credentials. A remote unauthenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service.

Progress Sitefinity 15.4.8623 before version 15.4.8630 has an improper access control vulnerability. A remote unauthenticated attacker can access restricted content, leading to full compromise of confidentiality, integrity, and availability.

CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.

In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.

Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.