https://insinuator.net/tags/asp.net/ Recent content in ASP.NET on Insinuator.net - Bold Statements Hugo en-us Mon, 08 Oct 2018 00:00:00 +0000 https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ Mon, 08 Oct 2018 00:00:00 +0000 https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ <h1 id="preface">Preface</h1> <p>For those who never heard of <em>Sitefinity</em> before, it is an <em>ASP.NET</em>-based Web Content Management System (<em>WCMS</em>), which is used to deploy and manage applications as other <em>CMS</em>‘s do. A bitter quick glance at <em>Sitefinity</em> and its advantages can be found in this <a href="https://www.progress.com/documentation/sitefinity-cms/sitefinity-overview">overview.</a></p> <p>Delving into the core of this blog post, recently I had the opportunity to look at <em>Sitefinity WCMS</em> in which I found two <em>reflected</em> <em>Cross Site Scripting</em> (<em>XSS</em>) (<em><a href="https://www.cvedetails.com/cve/CVE-2018-17053/" title="CVE-2018-17053 security vulnerability details">CVE-2018-17053</a> and <a href="https://www.cvedetails.com/cve/CVE-2018-17056/" title="CVE-2018-17056 security vulnerability details">CVE-2018-17056</a></em>), a* stored XSS* (<em><a href="https://www.cvedetails.com/cve/CVE-2018-17054/" title="CVE-2018-17054 security vulnerability details">CVE-2018-17054</a></em>) and an arbitrary file upload (<a href="https://www.cvedetails.com/cve/CVE-2018-17055/" title="CVE-2018-17055 security vulnerability details"><em>CVE-2018-17055</em></a>) vulnerabilities.</p>