Description

Kentico is an ASP.NET web content management system. The Staging API is used to replicate data between production and development systems.

Kentico Staging API contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive functionality, potentially leading to complete server compromise.

Remediation

Upgrade to the latest version of Kentico

References

Bypassing Authentication Like It's The 90s - Pre-Auth RCE Chain(s) in Kentico Xperience CMS

Kentico Hotfixes

Related Vulnerabilities

phpMyFAQ Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) Vulnerability (CVE-2023-1758)

Oracle Database Server CVE-2008-0344 Vulnerability (CVE-2008-0344)

Phusion Passenger Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-16355)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0786)

Oracle JRE CVE-2014-2414 Vulnerability (CVE-2014-2414)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Configuration Known Vulnerabilities Authentication Bypass CWE-287