Xperience
CVE-2018-5282
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework
AnalysisAI
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework Affected products include: Kentico Xperience. Version information: through 11.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).
Kentico Xperience contains a second authentication bypass in the Staging Sync Server through None-type password handling
Kentico Xperience through 13.0.172 contains an authentication bypass in the Staging Sync Server through empty SHA1 usern
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions
Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuratio
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary op
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certai
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload function
The Kentico Xperience CMS version 13.0 - 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/for
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process,
Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. Rated medium severity (CVSS 4.9), this
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today