PT-2019-18047 · Kentico · Kentico

Pavaris Jintanapramoth · Published 2019-02-08 · Updated 2024-08-04 · CVE-2019-6242

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico version 10.0.42

Description The issue allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. The vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time.

Recommendations For Kentico version 10.0.42, consider restricting access to the SMTP configuration page to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the privileges of Global Administrators to prevent them from accessing sensitive information like the cleartext SMTP Password.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-6242

Affected Products

Kentico

References · 4

• 🔥 https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2 · Exploit
• https://osv.dev/vulnerability/CVE-2019-6242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6242 · Security Note
• https://t.me/cvenotify/89060 · Telegram Post