PT-2019-12641 · Kentico · Kentico

CVE-2019-12102 · Publicado 2019-05-22 · Atualizado 2024-08-04

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kentico versions 11 through 12

Description The issue allows attackers to upload and explore files without authentication via the "cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs media.aspx" URI. However, the vendor disputes this report, stating that the media library permissions were not configured correctly by the researcher. By default, all users can read, modify, and upload files, and it is up to the administrator to decide who should have access to the media library and set the permissions accordingly.

Recommendations For Kentico versions 11 through 12, ensure that the media library permissions are configured correctly to restrict access to authorized users. Administrators should review and set the permissions according to their requirements to prevent unauthorized file uploads and exploration.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2019-12102

Produtos afetados

Kentico

Referências · 6

• 🔥 https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure · Exploit
• https://docs.kentico.com/k12/release-notes-kentico-12 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12102 · Aviso do Fabricante
• https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12102 · Nota de Segurança
• https://devnet.kentico.com/download/hotfixes · Aviso do Fabricante