CVE-2024-11626

Published: Jan 7, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

Affected (4)

Products: Progress: Sitefinity

Progress

1 product

Sitefinity

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Progress Sitefinity	From 15.0.8200 to 15.0.8230
Progress Sitefinity	From 15.1.8300 to 15.1.8328
Progress Sitefinity	From 15.2.8400 to 15.2.8422
Progress Sitefinity	From 4.0 to 14.4.8143

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025

Source: security@progress.com

Vendor Advisory

https://www.progress.com/sitefinity-cms

Source: security@progress.com

Product

Timeline

No history available yet.