CVE-2019-17392

CRITICAL 9.8CVE-2019-17392 · Published 26/11/2019 · updated 17/06/2026

In short

CVE-2019-17392 is a CRITICAL (CVSS 9.8) vulnerability affecting sitefinity (progress).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.3% of all vulnerabilities.
Fix: update to 10.0.6431, 10.1.6542, 9.1.6185, 9.2.6276 or later.

Package	Affected versions	Patched versions
sitefinity progress	`≥ 10.0, < 10.0.6431≥ 10.1, < 10.1.6542≥ 10.2, ≤ 10.2.6651≥ 11.0, ≤ 11.0.6739≥ 11.1, ≤ 11.1.6828≥ 11.2, ≤ 11.2.6934≥ 12.0, ≤ 12.0.7032≥ 12.1, ≤ 12.1.7128≥ 9.1, < 9.1.6185≥ 9.2, < 9.2.6276`	`10.0.643110.1.65429.1.61859.2.6276`

Description

Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.

References

knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019 · Vendor Advisory

More vulnerabilities in sitefinity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sitefinity

progress

≥ 10.0, < 10.0.6431≥ 10.1, < 10.1.6542≥ 10.2, ≤ 10.2.6651≥ 11.0, ≤ 11.0.6739≥ 11.1, ≤ 11.1.6828≥ 11.2, ≤ 11.2.6934≥ 12.0, ≤ 12.0.7032≥ 12.1, ≤ 12.1.7128≥ 9.1, < 9.1.6185≥ 9.2, < 9.2.6276

10.0.643110.1.65429.1.61859.2.6276

More vulnerabilities in sitefinity

See all →