CVE-2009-4367

The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

6.09% chance of exploitation in the next 30 days, 93th percentile

Published

2009-12-21

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/10513

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10513

References

• CVE Record
• NVD entry

Related

• CVE-2009-4366
• CVE-2009-4369
• CVE-2009-4365
• CVE-2009-4371
• CVE-2009-4364
• CVE-2009-4372