CVE-2009-4367

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-12-21 · updated 2026-06-16
Weakness: CWE-287

Description

The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.

Affected products

Sitecore Staging Module: through 5.4.0

References

http://osvdb.org/61147
http://secunia.com/advisories/37763
http://www.exploit-db.com/exploits/10513
http://www.securityfocus.com/archive/1/508529/100/0/threaded
http://www.securityfocus.com/bid/37388
https://exchange.xforce.ibmcloud.com/vulnerabilities/54881
https://www.sec-consult.com/files/20091217-0_sitecore_StagingModule_1.0.txt
http://osvdb.org/61147
http://secunia.com/advisories/37763
http://www.exploit-db.com/exploits/10513
http://www.securityfocus.com/archive/1/508529/100/0/threaded
http://www.securityfocus.com/bid/37388

Get alerted when CVE-2009-4367 or the next vulnerability affects your stack