CVE-2017-5965

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which…

published May 23, 2017

CVSS
—
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackage2.aspx to upload this archive and extract its contents, and visiting a URI under sitecore/ to execute the .asp file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01047 · 63.7th percentile
Published
2017-05-23T05:14Z
EPSS history
Timeline
  • 23 MAY 05:14Z
    The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which…
    cvelistv5