Progress Software Sitefinity exposes plain‑text credentials used to connect to the Sitefinity Insight service through its web services. A remote attacker who is authenticated and has access to a site with active Service Insight integration can retrieve these credentials, potentially allowing further compromise of back‑end systems. The weakness is a form of insufficiently protected credentials, which leads to a loss of confidentiality and the risk of unauthorized access to the Insight service.

Sitefinity versions from 8.0.5700 up to 13.3.7652 are affected. The vulnerability requires a non‑default site configuration, active Service Insight integration and valid back‑end authorization. All systems running versions within this range that meet those conditions must be considered vulnerable.

The CVSS score of 8.7 indicates a high severity level. Exploitation requires an authenticated session on the target web service, meaning the attacker must first acquire valid credentials to the Sitefinity portal. The EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS and the ability to retrieve plain‑text credentials make it a serious risk for organizations that rely on Sitefinity Insight for analytics or other back‑end services. The attacker can use the stolen credentials to access the Insight service or potentially pivot to other systems in the network depending on the scope of the Insight integration.