PT-2025-52324 · Kentico · Kentico Xperience

Published 2025-12-18 · Updated 2025-12-24 · CVE-2024-58317

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kentico Xperience (affected versions not specified)

Description A configuration issue in Kentico Xperience related to cookie security allows attackers to bypass SSL requirements when setting administration cookies through the web.config file. This occurs due to the incorrect handling of the 'requireSSL' attribute, which can compromise session security and authentication state. The issue impacts .NET Framework projects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-614

Related Identifiers

CVE-2024-58317

Affected Products

Kentico Xperience

References · 6

• https://osv.dev/vulnerability/CVE-2024-58317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58317 · Security Note
• https://t.me/cveNotify/146777 · Telegram Post
• https://twitter.com/CVEnew/status/2002117781425184873 · Twitter Post
• https://vulncheck.com/advisories/kentico-xperience-cookie-security-configuration · Note
• https://devnet.kentico.com/download/hotfixes · Patch, Vendor Advisory