CVE-2026-7313
Insufficiently Protected Credentials in Progress Sitefinity
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Progress Software Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| progress | sitefinity | From 8.0.5700 (inc) to 13.3.7652 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive plain-text credentials, which can be used by an attacker to access the Sitefinity Insight service. This can result in a compromise of confidentiality and integrity of data within the service. Given the CVSS score of 8.7, the impact is high, potentially allowing attackers to gain unauthorized access and manipulate data, though it does not affect availability.
Can you explain this vulnerability to me?
This vulnerability, identified as CWE-522, involves insufficient protection of credentials in web services within Progress Sitefinity versions from 8.0.5700 to 13.3.7652. A remote authenticated attacker can exploit this issue to obtain plain-text credentials that are used to connect to the Sitefinity Insight service. Exploitation requires that the Sitefinity Insight integration is active, the site configuration is non-default, and the attacker has valid back-end authorization.