medium6.9
CVE-2015-10142
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev.
Impact
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sitecore | Sitecore Experience Platform (XP) | before 8.0 |
| Update-3 (Rev. 141226) And | before 7.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.