Description
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sitecore Experience Platform (XP)
Default version status: unaffected
0 to < 8.0 Initial Release (rev. 141212)affected
Sitecore Content Management System (CMS)
Default version status: unaffected
0 to < 7.2 Update-3 (rev. 141226)affected0 to < 7.5 Update-1 (rev. 150130)affected