A vulnerability has been reported in Sitecore CMS, which can be exploited by malicious users to disclose sensitive information.

The vulnerability is caused due to the Sitecore web service allowing users to retrieve data from security databases, including e.g. password hashes of arbitrary users.

The vulnerability is reported in versions 5.3.1 rev. 071114. Other versions may also be affected.

Solution
Update to version 5.3.2 rev. 090212.

Provided and/or discovered by
National Australia Bank Security Assurance Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
Sitecore:
http://sdn5.sitecore.net/Products/Sitecore V5/Sitecore CMS 5,-d-,3/ReleaseNotes/V5,-d-,3,-d-,2/ChangeLog.aspx

Deep Links
Links available to Secunia VIM customers