CVE-2023-29375 File upload in n/a
Attackers can upload malicious files via the SharePoint connector in Progress Sitefinity, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29375?
CVE-2023-29375 is a critical vulnerability in n/a, published on 10 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.
Weakness: CWE-434
Which versions are affected by CVE-2023-29375?
It affects 1 product.
Products include Progress Sitefinity.
How do I fix CVE-2023-29375?
No fix has been published for CVE-2023-29375 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-29375 being exploited?
There is no known exploitation of CVE-2023-29375 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness
- CVE-2026-7312 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-7198 CWE-284: Improper Access Control in web services in Progress Sitefinity
- CVE-2019-17392 Auth bypass in n/a
- CVE-2017-15883 Auth bypass in n/a
Sources
Also known as GHSA-367q-63cf-925j.