CVE-2024-11626

State: Published
Severity: 8.4 High
Published: Jan 7, 2025
Updated: Jan 7, 2025
Reserved: Nov 22, 2024

Description

Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
SitefinityProgress Software Corporation	4.0 through 14.4.8142Affected 15.0.8200 through 15.0.8229Affected 15.1.8300 through 15.1.8327Affected 15.2.8400 through 15.2.8421Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.