PT-2019-12641 · Kentico · Kentico

Published 2019-05-22 · Updated 2024-08-04 · CVE-2019-12102

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kentico versions 11 through 12

Description The issue allows attackers to upload and explore files without authentication via the "cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs media.aspx" URI. However, the vendor disputes this report, stating that the media library permissions were not configured correctly by the researcher. By default, all users can read, modify, and upload files, and it is up to the administrator to decide who should have access to the media library and set the permissions accordingly.

Recommendations For Kentico versions 11 through 12, ensure that the media library permissions are configured correctly to restrict access to authorized users. Administrators should review and set the permissions according to their requirements to prevent unauthorized file uploads and exploration.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-12102

Affected Products

Kentico

References · 6

• 🔥 https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure · Exploit
• https://docs.kentico.com/k12/release-notes-kentico-12 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12102 · Security Note
• https://devnet.kentico.com/download/hotfixes · Vendor Advisory
• https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries · Note