PT-2019-18047 · Kentico · Kentico

Pavaris Jintanapramoth · Publicado 2019-02-08 · Atualizado 2024-08-04 · CVE-2019-6242

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico version 10.0.42

Description The issue allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. The vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time.

Recommendations For Kentico version 10.0.42, consider restricting access to the SMTP configuration page to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the privileges of Global Administrators to prevent them from accessing sensitive information like the cleartext SMTP Password.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-6242

Produtos afetados

Kentico

Referências · 4

• 🔥 https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2 · Exploit
• https://osv.dev/vulnerability/CVE-2019-6242 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6242 · Nota de Segurança
• https://t.me/cvenotify/89060 · Publicação no Telegram