Potential Use of the Sitefinity System for Distribution of Phishing Emails

Description

A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.

Scores

EPSS (exploitation in 30 days)

0.38% · top 68% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.

Weakness

• CWE-20 Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• Progress Software Corporation · Sitefinity

  • affected 15.0 – < 15.0.8223
  • affected 14.4 – < 14.4.8133
  • affected 14.3 – < 14.3.8029
  • affected 14.2 – < 14.2.7932
  • affected 14.1 – < 14.1.7828
  • affected 13.3 – < 13.3.7648

References (2)

• https://www.progress.com/sitefinity-cms (opens in a new tab)productx_transferred
• https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2023-6784-December-2023 (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-6784](https://trackcve.app/badge/CVE-2023-6784.svg)](https://trackcve.app/cve/CVE-2023-6784)

Record last updated 27 Nov 2024, 20:02 UTC.