PT-2018-6559 · Kentico · Kentico

Published 2018-03-23 · Updated 2025-12-19 · CVE-2017-17736

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Kentico versions 9.0 through 9.0.50 Kentico versions 10.0 through 10.0.47

Description: The issue allows remote attackers to obtain Global Administrator access. This can be achieved by visiting the "CMSInstall/install.aspx" endpoint and then navigating to the CMS Administration Dashboard.

Recommendations: For Kentico versions 9.0 through 9.0.50, update to version 9.0.51 or later. For Kentico versions 10.0 through 10.0.47, update to version 10.0.48 or later.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2017-17736

Affected Products

Kentico

References · 4

• 🔥 https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b · Exploit
• https://osv.dev/vulnerability/CVE-2017-17736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17736 · Security Note
• https://t.me/cveNotify/146415 · Telegram Post