CVE-2019-12102

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions correctly. The vendor states that by default all users can read/modify/upload files, and it’s up to the administrator to decide who should have access to the media library and set the permissions accordingly. See the vendor documentation in the references for more information

** EN DISPUTA ** Kentico 11 hasta la versión 12 permite a los atacantes cargar y explorar archivos sin autenticación a través de cmsmodules / medialibrary / formcontrols / liveselectors / insertimageormedia / tabs_media.aspx URI. NOTA: El proveedor disputa el informe porque el investigador no configuró los permisos de la biblioteca de medios correctamente. El proveedor declara que, de manera predeterminada, todos los usuarios pueden leer / modificar / cargar archivos, y depende del administrador decidir quién debe tener acceso a la biblioteca de medios y establecer los permisos en consecuencia. Consulte la documentación del proveedor en las referencias para obtener más información.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2019-05-15 CVE Reserved
2019-05-22 CVE Published
2024-11-15 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

References (4)

URL	Tag	Source
https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries	X_refsource_misc
https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure	Broken Link

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://devnet.kentico.com/download/hotfixes	2024-05-17
https://docs.kentico.com/k12/release-notes-kentico-12	2024-05-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Kentico Search vendor "Kentico"		Kentico Search vendor "Kentico" for product "Kentico"				>= 11.0.0 <= 12.0 Search vendor "Kentico" for product "Kentico" and version " >= 11.0.0 <= 12.0"		-		Affected