CVE-2015-10142
Last modified
CVE-2015-10142 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2015-10142?
How severe is CVE-2015-10142?
How do I fix CVE-2015-10142?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-10137The Website Contact Form With File Upload plugin for WordPre…9.8
- CVE-2015-10138The Work The Flow File Upload plugin for WordPress is vulner…9.8
- CVE-2015-10139The WPLMS theme for WordPress is vulnerable to Privilege Esc…8.8
- CVE-2015-1014A successful exploit of these vulnerabilities requires the l…
- CVE-2015-10140The Ajax Load More plugin before 2.8.1.2 does not have autho…8.8
- CVE-2015-10141An unauthenticated OS command injection vulnerability exists…9.3
- CVE-2015-10143The Platform theme for WordPress is vulnerable to unauthoriz…9.8
- CVE-2015-10144The Responsive Thumbnail Slider plugin for WordPress is vuln…8.8
- CVE-2015-10145Gargoyle router management utility versions 1.5.x contain an…8.8
- CVE-2015-10146The Thumbnail Slider With Lightbox plugin for WordPress is v…4.9
- CVE-2015-10147The Easy Testimonial Slider and Form plugin for WordPress is…4.9
- CVE-2015-10148Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior …8.8
Are you affected by CVE-2015-10142?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST