CVE-2015-10142 - CVE House
Back to Database
Status published Medium CVE-2015-10142

Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path

Vulnerability Description

Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-10142

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Sitecore

References

More from Sitecore

View All →
CVE-2025-53694
Information Disclosure in ItemServices API
High 7.5
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Critical 9.8
CVE-2025-53692
Sitecore Experience Platform Cross-Site Scripting Vulnerability
High 7.1
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
High 8.8
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Critical 9

Affected Vendor

Affected Software

Experience Platform (XP), Content Management System (CMS)
Vulnerable Versions:
0

Timeline

Official Publish: July 25th, 2025
Last Modified: May 15th, 2026
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-610

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.