The version of Sitefinity installed on the remote host is affected by multiple vulnerabilities :

 - An XSS vulnerability in Telerik.ReportViewer affects versions 4.2 through 11.0 (CVE-2017-9140)

 - An XSS vulnerability in?Identity Server affects versions 10.0 through 11.0 (CVE-2018-17053, CVE-2018-17054)

 - An XSS vulnerability in Service Stack affects versions 10.2 through 11.0 (CVE-2018-17056)

 - An arbitrary file upload vulnerability affects versions 4.0 through 11.0 (CVE-2018-17055)

 - An arbitrary code execution in Dynamic Linq Parser affects versions 4.0 through 11.0

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Sitefinity installed on the remote host is prior to 10.0.6412.0. It is, therefore, affected by multiple vulnerabilities in Telerik DialogHandler and RadAsyncUpload :

 - A cryptographic weakness exists in Telerik.Web.UI that can be exploited to disclose encryption keys

 - An unrestricted file upload vulnerability exists in Telerik.Web.UI due to weak encryption

 - An insecure direct object reference vulnerability exists in Telerik.Web.UI due to user input used directly by RadAsyncUpload without validation

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of jQuery File Upload running on the remote host is affected by an arbitrary file upload vulnerability. An unauthenticated attacker could leverage this vulnerability to gain access to the host in the context of the web application user.

Note: This has been detected using an active check and should be remediated immediately.

The remote web server uses the default Microsoft IIS index page. This page may contain some sensitive data like the server root and installation paths.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

The remote web server uses the default Lighttpd index page. This page may contain some sensitive data like the server root and installation paths.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

The remote web server is running a version of Apache Spark that is affected by a Cross-Site Scripting (XSS) vulnerability due to a flaw in Spark cluster's UI's job and stage info pages, which allows a remote attacker to use specially crafted requests that can lead to arbitrary HTML and script code injection into a user's browser to be executed within the security context of the affected site.

Apache Struts 2 installed on the remote host is running a OGNL console. While this environment can help speed up development of web applications, it can leak information about the underlying web applications as well as the installation of Struts, Java, and other related items on the remote host and lead to further compromise.

Apache Struts 2 installed on the remote host is configured to operate in development mode (devMode). While this environment can help speed up development of web applications, it can leak information about the underlying web applications as well as the installation of Struts, Java, and other related items on the remote host.

The remote web server uses the default Apache index page. This page may contain some sensitive data like the server root and installation paths.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

The installation of Apache Tomcat detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

It is possible to send debug statements to the remote ASP scripts via the http DEBUG method. A remote, unauthenticated attacker may leverage this to alter the runtime of the remote scripts.

The ASP.NET web application running in the root directory of the remote web server has application tracing enabled. This allows an unauthenticated, remote attacker to view the last 50 web requests made to the server, including sensitive information like Session ID values and the physical path to the requested file.

The scanner has detected Nginx default index pages on the remote web server.

This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.

The installation of Apache detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The installation of PHP detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The installation of Microsoft Internet Information Services (IIS) detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The installation of Joomla! detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The installation of Drupal detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The installation of WordPress detected on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The Joomla! application running on the remote web server is affected by a remote code execution vulnerability due to improper sanitization of the User-Agent header field when saving session values. An unauthenticated, remote attacker can exploit this, via a serialized PHP object, to execute arbitrary PHP code.

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the Coder module, specifically in file coder_upgrade.run.php, due to improper validation of user-supplied input to the unserialize() function. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary PHP code.

The remote web server is running a version of Drupal that is affected by a SQL injection vulnerability due to a flaw in the Drupal database abstraction API, which allows a remote attacker to use specially crafted requests that can result in arbitrary SQL execution. This may lead to privilege escalation, arbitrary PHP execution, or remote code execution.

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the bundled RESTful Web services (RESTWS) module due to a flaw in how default page callbacks for Drupal entities are altered when handling specially crafted requests. An unauthenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary PHP code.

The Joomla! installation running on the remote web server is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or modification of arbitrary data.

The WordPress application running on the remote web server is version 4.7.x prior to 4.7.2. It is, therefore, affected by a privilege escalation vulnerability in the REST API due to a failure to properly sanitize user- supplied input to the 'id' parameter when editing or deleting blog posts. An unauthenticated, remote attacker can exploit this issue to run arbitrary PHP code, inject content into blog posts, modify blog post attributes, or delete blog posts.

The WordPress REST API is enabled by default as of version 4.7.0. This vulnerability was silently patched in WordPress version 4.7.2.

Note that WordPress is reportedly affected by additional vulnerabilities; however, the scanner has not tested for these.

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

Note: This has been detected using an active check and should be remediated immediately.

A public facing WordPress XML-RPC interface has been detected.

An attacker may be able to launch attacks against the web server Via XML-RPC including:
 - Login into WordPress backend Administrative interface
 - Brute force user credentials
 - Use pingbacks (for scanning or fingerprinting for example)

ID	Name	Severity
112511	Sitefinity 8.1.x < 8.1.5860.0 Multiple Vulnerabilities	high
112510	Sitefinity 8.0.x < 8.0.5770.0 Multiple Vulnerabilities	high
112509	Sitefinity 7.3.x < 7.3.5690.0 Multiple Vulnerabilities	high
112508	Sitefinity 7.2.x < 7.2.5350.0 Multiple Vulnerabilities	high
112507	Sitefinity 7.1.x < 7.1.5240.0 Multiple Vulnerabilities	high
112506	Sitefinity 7.0.x < 7.0.5140.0 Multiple Vulnerabilities	high
112505	Sitefinity 6.3.x < 6.3.5050.0 Multiple Vulnerabilities	high
112504	Sitefinity 6.2.x < 6.2.4930.0 Multiple Vulnerabilities	high
112503	Sitefinity 6.1.x < 6.1.4720.0 Multiple Vulnerabilities	high
112502	Sitefinity < 6.0.4230.0 Multiple Vulnerabilities	high
112501	Sitefinity < 10.0.6412.0 Multiple Vulnerabilities	critical
98233	jQuery File Upload Arbitrary File Upload	critical
112500	Microsoft IIS Default Index Page	medium
112360	Lighttpd Default Index Page	medium
112470	Apache Spark < 2.1.3 / 2.2.x < 2.2.2 / 2.3.x < 2.3.1 XSS in UI	medium
112371	Apache Struts 2 OGNL Console Detected	medium
112370	Apache Struts 2 DevMode Enabled	medium
112351	Apache Default Index Page	medium
98232	Apache Tomcat Unsupported Version	critical
112353	ASP.NET DEBUG Method Enabled	medium
112352	Microsoft ASP.NET Application Tracing trace.axd Information Disclosure	medium
112350	Nginx Default Index Page	medium
98231	Apache Unsupported Version	critical
98230	PHP Unsupported Version	critical
113029	Microsoft IIS Unsupported Version	critical
98229	Joomla! Unsupported Version	critical
98228	Drupal Unsupported Version	critical
98227	WordPress Unsupported Version	critical
98222	Joomla! User-Agent Object Injection RCE	critical
98221	Drupal Coder Module Deserialization RCE	critical
98220	Drupal Database Abstraction API SQLi	critical
98219	Drupal RESTWS Module Page Callback RCE	critical
98218	Joomla! 3.7.0 < 3.7.1 fields.php getListQuery() Method SQLi	critical
98217	WordPress 4.7.x < 4.7.2 REST API 'id' Parameter Privilege Escalation	high
98216	Drupal < 7.58 / 8.x < 8.3.9 / 8.4.x < 8.4.6 / 8.5.x < 8.5.1 Remote Code Execution	critical
98215	WordPress XML-RPC Interface Detected	medium

Detections

Analytics

Component Vulnerability Family for Web App Scanning

high

high

high

high

high

high

high

high

high

high

critical

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

medium