CRITICAL
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI
Published May 22, 2019
9.1
CRITICALCVSS 3.0
EPSS 2.16%
Description
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions correctly. The vendor states that by default all users can read/modify/upload files, and it’s up to the administrator to decide who should have access to the media library and set the permissions accordingly. See the vendor documentation in the references for more information
Affected products
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://devnet.kentico.com/download/hotfixes x_refsource_MISCVendor Advisory
- https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries x_refsource_MISC
- https://docs.kentico.com/k12/release-notes-kentico-12 x_refsource_MISCRelease NotesVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3754 Advisory
- https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure x_refsource_MISCBroken Link
| Link | Providers | Tags |
|---|---|---|
| https://devnet.kentico.com/download/hotfixes | x_refsource_MISCVendor Advisory | |
| https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries | x_refsource_MISC | |
| https://docs.kentico.com/k12/release-notes-kentico-12 | x_refsource_MISCRelease NotesVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3754 | Advisory | |
| https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure | x_refsource_MISCBroken Link |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published May 22, 2019
Updated Nov 15, 2024
Reserved May 15, 2019
Link CVE-2019-12102
CISA Vulnrichment
Updated Apr 24, 2024
Red Hat
No data
GitHub
No data