Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.
AnalysisAI
In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. Affected products include: Kentico Xperience. Version information: before 13.0.66.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Kentico Xperience contains a second authentication bypass in the Staging Sync Server through None-type password handling
Kentico Xperience through 13.0.172 contains an authentication bypass in the Staging Sync Server through empty SHA1 usern
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password fie
Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuratio
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary op
Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certai
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload function
The Kentico Xperience CMS version 13.0 - 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/for
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process,
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today