Read the docs
TI-2023-06199 Aliases CVE-2023-6784GHSA-xghf-952v-933j

Potential Use of the Sitefinity System for Distribution of Phishing Emails

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A malicious user could potentially use the Sitefinity system for the distribution of phishing emails.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed Sitefinity (Progress Software Corporation): 15.0.8223, 14.4.8133, 14.3.8029 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressSitefinity15.0 to before 15.0.8223; 14.4 to before 14.4.8133; 14.3 to before 14.3.8029; 14.2 to before 14.2.7932; 14.1 to before 14.1.7828; 13.3 to before 13.3.764815.0.8223, 14.4.8133, 14.3.8029, 14.2.7932, 14.1.7828, 13.3.7648Patch availableCNA
  • Sitefinity VendorProgress Affected 15.0 to before 15.0.8223; 14.4 to before 14.4.8133; 14.3 to before 14.3.8029; 14.2 to before 14.2.7932; 14.1 to before 14.1.7828; 13.3 to before 13.3.7648 Fixed in 15.0.8223, 14.4.8133, 14.3.8029, 14.2.7932, 14.1.7828, 13.3.7648 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*4.0 to before 13.3.7648; 14.1 to before 14.1.7828; 14.2 to before 14.2.7932; 14.3 to before 14.3.8029; 14.4 to before 14.4.8133; 15.0 to before 15.0.8223VulnerableProgress
  • cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:* Versions 4.0 to before 13.3.7648; 14.1 to before 14.1.7828; 14.2 to before 14.2.7932; 14.3 to before 14.3.8029; 14.4 to before 14.4.8133; 15.0 to before 15.0.8223 Vulnerable ·Progress

Remediation

  • Fix · CNA Sitefinity (Progress Software Corporation) Fixed in 15.0.8223, 14.4.8133, 14.3.8029, 14.2.7932, 14.1.7828, 13.3.7648

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6784
  2. 2026-10-03 Alias added: GHSA-xghf-952v-933j

References

Advisory 1

Other 1

  • TI-2017-06690 Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-12346 Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor. CVSS 3.1MEDIUM 6.5
  • TI-2023-13767 An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before… CVSS 3.1CRITICAL 9.8
  • TI-2026-06317 Improper access control in Progress Sitefinity CVSS 3.1CRITICAL 9.8
  • TI-2017-11630 Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2019-12987 Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password… CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences