CVE-2017-18178: Progress Sitefinity

Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days.

Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a certain %40 syntax. This is fixed in 10.1.

Affected products

• Progress Sitefinity: version 9.1 only

Published 2018-02-12. Last modified 2026-06-17.