CVE-2019-17392

Name of the Vulnerable Software and Affected Versions Progress Sitefinity version 12.1

Description The issue is related to a weak password recovery mechanism for forgotten passwords. This is due to the mishandling of the HTTP Host header, which can be exploited.

Recommendations For Progress Sitefinity version 12.1, consider restricting access to the password recovery mechanism until a proper fix is implemented. As a temporary workaround, avoid using the password recovery feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.