Executive Summary

This vulnerability, identified as CWE-522, involves insufficient protection of credentials in web services within Progress Sitefinity versions from 8.0.5700 to 13.3.7652. A remote authenticated attacker can exploit this issue to obtain plain-text credentials that are used to connect to the Sitefinity Insight service. Exploitation requires that the Sitefinity Insight integration is active, the site configuration is non-default, and the attacker has valid back-end authorization.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to exposure of sensitive plain-text credentials, which can be used by an attacker to access the Sitefinity Insight service. This can result in a compromise of confidentiality and integrity of data within the service. Given the CVSS score of 8.7, the impact is high, potentially allowing attackers to gain unauthorized access and manipulate data, though it does not affect availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves insufficient protection of credentials, allowing a remote authenticated attacker to obtain plain-text credentials used to connect to the Sitefinity Insight service.

Exposure of plain-text credentials can lead to unauthorized access to sensitive data or systems, which may result in violations of data protection regulations such as GDPR or HIPAA that require appropriate safeguards for sensitive information.

Therefore, exploitation of this vulnerability could negatively impact compliance with standards and regulations that mandate secure handling of credentials and protection of personal or sensitive data.

Useful 0 Not Useful 0