PT-2025-52327 · Kentico · Kentico Xperience

Bank · Published 2025-12-18 · Updated 2025-12-19 · CVE-2024-58320

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kentico Xperience (affected versions not specified)

Description An information disclosure issue exists in Kentico Xperience that allows unauthorized public users to access sensitive hostname details of the administration interface during authentication. Attackers can obtain confidential hostname configuration information via a public endpoint, which may reveal internal network details. The issue occurs when accessing the administration interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2024-58320

Affected Products

Kentico Xperience

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-58320 · Security Note
• https://osv.dev/vulnerability/CVE-2024-58320 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002104302911750198 · Twitter Post
• https://vulncheck.com/advisories/kentico-xperience-authentication-information-disclosure · Note
• https://devnet.kentico.com/download/hotfixes · Patch, Vendor Advisory